topic Re: Query regarding abandoned files seen in HP-UX in Operating System - HP-UX

Query regarding abandoned files seen in HP-UX

AL_3001 — Thu, 19 Feb 2009 15:35:00 GMT

Hello Gurus,

I need to clear my understanding about abandoned files. I first want to understand, What are abandoned file and why does this happen? Secondly, how to prevent this to happen.

I have an example to make this a bit more useful.. See the attached text file.

My question is, what does the id 3836 in the place of file owner signify? Becozuse there is no user in /etc/passwd as 3836.

Next question, how to prevent this from happening.

If anyone has more question, please ask me. I need to resolve this issue.

Thank You.

Regards,
Ashish

Re: Query regarding abandoned files seen in HP-UX

Ivan Krastev — Thu, 19 Feb 2009 15:42:49 GMT

Look in older backups of /etc/passwd file for user with id 3836.

regards,
ivan

Re: Query regarding abandoned files seen in HP-UX

Pete Randall — Thu, 19 Feb 2009 15:45:07 GMT

The user who used to correspond to uid 3836 has been removed from /etc/passwd but the files owned by this user were left behind, that is why use 3836 as the owner. You can use the find command to clean them out: find /home /tmp /var/tmp -user 3836 |xargs rm -rf

The way to prevent this is to clean out the files when the user is removed.

Pete

Re: Query regarding abandoned files seen in HP-UX

Michael Mike Reaser — Thu, 19 Feb 2009 15:47:17 GMT

This can occur when files are moved from one system to another via tar or another archiver. The user 3836 was the numeric user ID who owned the files on the other system, but when the files are restored on your system the "3836" is shown by ls and ll because that's the information in the files' directory entries. If you had a username assigned to 3836 on your system, that username would show up instead of 3836.

In other words, these files may not be "abandoned", rather they were never "adopted" in the first place by a real user on your system.

Re: Query regarding abandoned files seen in HP-UX

Pete Randall — Thu, 19 Feb 2009 15:47:40 GMT

"why you see 3836", not "why use 3836". Sorry.

Re: Query regarding abandoned files seen in HP-UX

T G Manikandan — Thu, 19 Feb 2009 15:50:09 GMT

you need to check the backup for the /etc/passwd to see which user was assigned this userid.

It is always recommended to remove the user directory files when removing the users

#userdel -r

Re: Query regarding abandoned files seen in HP-UX

Steven E. Protter — Thu, 19 Feb 2009 15:58:28 GMT

Shalom,

I would not consider these files abandoned.

Here is how it could happen.

HP-UX system is integrated into Windows ADS domain. User has rights and writes a file.

Server is booted from the domain, removed, or user is deleted in the domain controller. Suddenly files without owners.

You can even make it happen localy.

Create a user named charles, log on as him, write a couple of files, then delete the user. The files can be left behind and appear to be owner less.

SEP

Re: Query regarding abandoned files seen in HP-UX

Bill Hassell — Fri, 20 Feb 2009 01:28:01 GMT

There is no concept of an abandoned file in Unix. 100% of all user IDs associated with a file are numbers. The /etc/passwd file provides a user-friendly translation for processes such as ls -l so you don't have to remember that a particular filed owned by 364 is associated with a user login name.

Created files are associated (by default) to the current user's number and stored that way in the directory. Just like /etc/hosts which associates a long IP address with one or more computer names, /etc/passwd is used to translate the number to a user login ID. You can change any file (with appropriate permissions) to any number in the UID range, like this:

touch /tmp/uid_test
ll /tmp/uid_test
chown 12345 /tmp/uid_test
ll /tmp/uid_test
rm -i /tmp/uid_test

AS you can see, you can change the ownership of a file or directory to any number. Whether this number corresponds to a user ID in your /etc/passwd file is not checked, nor should it be. If you need the file, assign the file to the proper owner.

Re: Query regarding abandoned files seen in HP-UX

AL_3001 — Thu, 09 Apr 2009 10:54:07 GMT

Thanks a lot.