shell script to find orphaned files

[shell script]

Hello,

I am looking at a shell script to find unowned files and directories on 1000+ servers. ( a mix of AIX, HPUX and Linux). I know i can use
#find / -nouser -o -nogroup -print
but i was wondering if there is any other way(using awk) that may speed up the search. Also i would like to store the results of this script on each server under /tmp.

Any help will be highly appreciated.

Thanks.

[James R. Ferguson]

Hi Hasn:

Using 'find' as you have is going to deliver what you seek. Why do you think 'awk' is going to help you?

If you want to report more than just the name of the file, do:

# find / -nouser -o -nogroup -exec ls -ld {} + > /tmp/filelist

Using the "+" terminator to the '-exec' argument creates a list of arguments to be passed to the spawned process like piping to 'xargs' would do. This is very efficient.

You could wrap this in an 'ssh' loop that queries a list of available servers.

Regards!

...JRF...

[shell script]

Can you please tell me more about the ssh loop process. As I said i have the servers broken down by flavor (AIX, HPUX) and over 1000 plus.

Thanks for the quick reply.

[Dennis Handly]

>Can you please tell me more about the ssh loop process?

If you have a file with the list of servers:
for server in $(< server_file); do
ssh $server -n "find / -nouser -o -nogroup -exec ls -ld {} + > /tmp/filelist"
done

I'm not sure if Linux or AIX has this Posix mandated "-exec ... +" option, if not, you may need to toss those boxes. ;-) Or have a customized script on each box. Or have lists of good servers and bad.

[James R. Ferguson]

Hi (again):

> Can you please tell me more about the ssh loop process

Use a Secure Shell with public keys in lieu of an insecure remote shell ('remsh').

Define a list of hosts; one hostname per line in a file and do:

#!/usr/bin/sh
while read HOST X
do
ssh ${HOST} -n 'find /tmp -nouser -o -nogroup > /tmp/orphaned'
done < /tmp/hosts

Regards!

...JRF...

[shell script]

Thanks for the help. One last question, since i will have this run against a huge number of boxes. I do have an app id to logon using ssh. Where would i incorporate the app id to logon the boxes using ssh.

Pardon my ignorance, I am new to scripting.

Thanks again.

[James R. Ferguson]

Hi (again):

> One last question, since i will have this run against a huge number of boxes. I do have an app id to logon using ssh. Where would i incorporate the app id to logon the boxes using ssh.

You need to setup public keys without a pass-phrase. These two links should provide you the information you need to easily do this:

http://sial.org/howto/openssh/publickey-auth/

http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=1254688&admit=109447626+1227965745456+28353475

Please don't forget to evaluate the help you have received when you are satisfied. See:

http://forums11.itrc.hp.com/service/forums/helptips.do?#28

Regards!

...JRF...

[Doug O'Leary]

Hey;

I typically do things like this in stages.

1. Create the find script and distribute it to your hosts.

for h in $(cat list-o-hosts)
do
echo ${h}
scp -q find_script ${h}:/tmp
done

2. Second stage is to run the script.

for h in $(cat list-o-aix-hosts)
do
echo ${h}
ssh ${h} /tmp/find_script
done

3. SCP the results back to where ever you want to analyze them:

for h in $(cat list-o-hosts)
do
echo ${h}
scp -q ${h}:/tmp/results_file ./${h}_results_file
done

Now, all *that* being said, if you were to run the find script exactly as listed above and the loops exactly as written, your terminal is going to be open a *very* long time as all the hosts would be done sequentially.

I would suggest adding a nohup or an at now command sequence to wrap the find so your commands come back quicker. You could add an email at the end of the script to tell you when the host was done with the find.

Also, realize that the find command listed above will also search nfs filesystems as well - probably not something you want to happen.

You could try something like:

find / ! -local -prune -o \( -nouser -o -nogroup -print \)

Another option would be to add logic to identify the mount points to search and search those specifically. This would require a bit more scripting but would probably be more reliable in the long run - particularly if this is going to be more than a one time good deal.

#!/bin/ksh

Host=$(hostname)
Log=/tmp/results_file
set -A mps $(mount | grep /dev | awk '{print $1}')
at now << eof
find ${mps[*]} -xdev -nouser -nogroup -print > ${Log}
date | mailx -s "${Host} finished" ${admin}
eof

for instance. The thing to be careful of there is that you don't have too many mount points. The system I verified the mount command has 80 separate filesystems.

There's also the potential for OS differences. -xdev, for instance, is -mount on solaris (if I remember right) and might be completely different in aix.

That should at least get you started...

Doug O'Leary

[Doug O'Leary]

Also, since there was a whole bunch of posts between the one I read and the one I responded to...

Be careful of using an appuser ID to run find commands across the entire system as they won't have access to any number of directories.

chmod 700 ${HOME}

for instance, would completely prevent any non-root user from accessing my home directory.

Doug

[shell script]

Doug,

Thanks for your detailed reply. The only thing is, I will have to run this script from one control server which can reach out all the servers. Would you mind making changes to the script to perform this. I can have this script run as root (not a problem) but I need one script which can be invoked which will reach out individual servers and store those results on the servers itself.

Thanks.