who took putty session!

Hi All,

Someone in my team logged on to a ESX Host via putty (from root id) and deleted some files.

Is there a way I can find out the IP address from where the connection was made ?

Thanks