topic Folder getting removed in Operating System - HP-UX

Folder getting removed

Sanjiv Sharma_1 — Sun, 12 Dec 2004 20:50:08 GMT

Hi,

Setup: N4000/HP-UX 11.00/Oracle 9i

I have a folder /opt/oracle/xxx/admin/yyy/tiger.

The folder tiger is getting removed quite often and we have to recreate it.

Only xxx user has write permission to the tiger folder. But xxx doesn't seems to run any cronjob or command to remove it. No information found in the .sh_history of xxx regarding the removal of tiger.

Is there a way to trace who (which user or any cronjob) is removing this folder?

Thank you,
Sanjiv

Re: Folder getting removed

Steven E. Protter — Sun, 12 Dec 2004 21:08:31 GMT

Linux has a command called chattr

chattr +i /opt/oracle/xxx/admin/yyy/tiger

Nobody even root is going to remove it.

Might want to look into finding the source and compiling chattr on hpux. Or there may be an equivalent command that I don't know.

Beyond that either the user is doing it or root is via a cron job.

If you have cron jobs that clean up folders/files more than a certain number of days old this is a candidate for removal.

Its got to be cron and its probably a find +mtime job doing it.

All cron jobs have entries in the cron logs. If you could ascertain the time it happened, you can limit the amount of cron log entries you need to read.

see /var/adm/cron/log

SEP

Re: Folder getting removed

Sanjiv Sharma_1 — Sun, 12 Dec 2004 22:14:00 GMT

SEP,

I do have checked the /var/adm/cron/log but didn't find any cronjob which could have removed the folder /opt/oracle/xxx/admin/yyy/tiger.

Re: Folder getting removed

Animesh Chakraborty — Mon, 13 Dec 2004 02:02:24 GMT

Hi Sanjiv,
You must check the permissions of all the sub directories in the path.
What is the permission of your yyy directory ?
To isolate the problem, put sticky bit in the tiger directory.
chmod 1744 (whatever permission you want for others) /opt/oracle/xxx/admin/yyy/tiger
and monitor.

This will prevent removing the files by others under tiger directory.

Thanks
Animesh

Re: Folder getting removed

Sanjiv Sharma_1 — Tue, 14 Dec 2004 00:32:52 GMT

Some inputs. The folder is getting removed at about 00:22 am midnight everyday.

I am trying to figure out the cronjob which may be responsible for this.

Re: Folder getting removed

Cheryl Griffin — Tue, 14 Dec 2004 07:47:04 GMT

Why don't you trace the rmdir command with a wrapper? Look at the following thread for Bill's wrapper scripts. You can leverage off of what he has supplied.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=113459

Re: Folder getting removed

Mark Ellzey — Tue, 14 Dec 2004 09:45:41 GMT

Sanjiv,

As Cheryl says, wrap up the rmdir command in a shell script. You may also want to do the same for the rm command, as whomever is doing the removing could be using 'rm -r', rather than 'rmdir'.

Regards,
Mark

Re: Folder getting removed

Bill Hassell — Tue, 14 Dec 2004 10:29:49 GMT

As far as restricting a directory from getting removed, in Unix, the ability to remove a file (or a directory which is itself a file) has NOTHING to do with permissions of the file or directory. A file or directory with 000 permissions can be removed by anyone if the file/directory is under a directory with 777 permissions. So to restrict the removal of this directory, change the permissions of the parent directory. Since the directory is always removed at the same time, it is very likely a cron (or possible a repetitive at command or even a script that sleeps for 24 hours.

Re: Folder getting removed

Massimo Bianchi — Tue, 14 Dec 2004 11:31:50 GMT

Is there any entry in the syslog.log for any user ?

Check also with the command "last", and check the logs for any user, entering at those hours..

Massimo

Re: Folder getting removed

Dave La Mar — Tue, 14 Dec 2004 17:36:54 GMT

Sanjiv,
To add to what others have said...
We have on occasion found files removed by a third party application. This would, of course, mean you would have to have a third party application accessing this file.

Happy hunting.

Regards,

dl