topic Re: How can this happen? in Operating System - HP-UX

How can this happen?

Bruce Baillie — Thu, 22 Feb 2001 14:47:17 GMT

I have a C110 HP-UX 10.20 whos only purpose is NIS server, NFS server, and application license server. No one actually works on this system. I just logged in and found the entire contents of the /etc directory also in the /home directory with all sub directories and symbolic links. The strange thing is the date and time is the same on everything, Jan 18 07:49. Could this be corruption? Should I just delete it all?

Re: How can this happen?

Dan Hetzel — Thu, 22 Feb 2001 15:06:59 GMT

Hi Bruce,

One thing is sure... It shouldn't be there !!

You may check with 'last' to see who was logged in at that time. The fact that all files and directories have the same timestamp isn't strange. As /etc is quite small doing a 'cp -r' wouldn't take longer than a minute.

Once you have investigated, it's safe to delete this directory.

Regards,

Dan

Re: How can this happen?

Bruce Baillie — Thu, 22 Feb 2001 15:15:13 GMT

Last shows a root login for 7 minutes in that time frame. cp will not copy the symbolic links. The way I copy symbolic links is through tar.

Re: How can this happen?

Dan Hetzel — Thu, 22 Feb 2001 15:22:16 GMT

Hi Bruce,

'cp' was an example. As you said, 'tar' would copy the links as would 'cpio -pdvulm'

Don't you have process accounting turned on? This would show which commands have been used by root at that time.

Dan

Re: How can this happen?

Bruce Baillie — Thu, 22 Feb 2001 18:57:34 GMT

Process accounting is not enabled. I removed everything that didn't belong and the system is still up. The /etc directory is intact so I guess no harm was done. Still very strange.

Re: How can this happen?

John Bolene — Thu, 22 Feb 2001 21:34:41 GMT

You can look at the .sh_history file for that user and see what commands they did. Maybe it was an innocent typo as I have done some really stupid things myself.