topic Re: Directory is missing in Operating System - HP-UX

Directory is missing

mrk_1 — Tue, 23 Sep 2008 12:01:35 GMT

Hi All,

Some of the important directory is missing on hp-ux box. As I am having a root privilege, How could find out who has deleted those folder?
And Is it possible to take back of this folder now?

Thanks.

Re: Directory is missing

Ivan Krastev — Tue, 23 Sep 2008 12:06:15 GMT

Find what directories were deleted.
Check for latest backup and restore it or do a full restore from Ignite.

Check history file(s) for 'rm' commands.

regards,
ivan

Re: Directory is missing

Kenan Erdey — Tue, 23 Sep 2008 12:08:42 GMT

Hi,

if you know when it's deleted check logins with last -R and check IP's. if you have backup or ignite-backup you can recover. if these files are binaries, libraries etc you can copy files from an identical server.

Kenan.

Re: Directory is missing

James R. Ferguson — Tue, 23 Sep 2008 12:08:52 GMT

Ram:

> How could find out who has deleted those folder?

The word is "directory" in UNIX. You might examine any scripts that you recently modified. There are safe ways to code and their are unsafe ways. Of course, the damage may have been done at the command line. You could try examining your shell history.

> And Is it possible to take back of this folder now?

Without knowing what was deleted, the answer varies. Was it just a directory? (then recreate it). Was a directory and its files deleted? (then a good backup may be appropriate to restore (partially)). Does it really matter? (then maybe this is a good lesson).

UNIX (and LINUX) isn't that other operating system. There is no "recycle bin". UNIX is designed to do whatever you tell it to do without fuss.

Regards!

...JRF...

Re: Directory is missing

MarkSyder — Tue, 23 Sep 2008 12:17:18 GMT

There is another possibility: is one of your discs not available? What is the result of

ioscan -fnC disk

?

If you have a bad disc, I hope you have a good backup.

Mark Syder (like the drink but spelt different)

Re: Directory is missing

sreekanthtm — Tue, 23 Sep 2008 12:29:39 GMT

Permision is another factor, which can cause this issue. Are u sure, that you have root privilage. Please login as root and confirm it.

Which directory got deleted? Is it a system directory OR data? Check the history of commands, may be accidentally deleted the files or wrong command.

Re: Directory is missing

mrk_1 — Tue, 23 Sep 2008 12:44:59 GMT

Thank you all for the quick response.

When I issue the command last -R, it response that, pid exceeds MAXPID: wtmp file corrupted.
I tried this in root user.

I remeber the folder name. Is not a system directory, Its a data only. But I dont know where I have to check the backup of this folder. I am not sure abt ignite backup.

Please help me out..

Thank you..

Re: Directory is missing

Ganesan R — Tue, 23 Sep 2008 12:49:56 GMT

Hi,

Have restore from last good backup is the only way to restore if it is really missing. If directories or deleted by some script then history also won't be able to provide the details.

Just to confirm ensure it is not NFS mount and unmounted by someone.

Thanks.

Re: Directory is missing

MarkSyder — Tue, 23 Sep 2008 12:51:03 GMT

If it's not a system directory it won't be on an ignite backup. What do you use for data backups? Data protector? Fbackup?

Mark

Re: Directory is missing

OldSchool — Tue, 23 Sep 2008 15:22:25 GMT

again, it's going to depend on the kind of data.

if it was part of a database structure, then your going to have to recover the db to the last consistent backup. if it was simply "storage space" for documents, then it might not matter at all.

if it was system config information, then it needs to come off a backup tape.

without information as to what was actually stored there, its all just a guess.

you *do* have backups, right?

Re: Directory is missing

Suraj K Sankari — Tue, 23 Sep 2008 16:01:54 GMT

Hi,

This type of problem is common where too many new users (who is new to unix) are there, Most of the time I found those missing directories are not removed from the system, those directory has been moved from their original location.
So better check with find command, I hope you will find those missing directory here is the command

#cd /
#find / -name missingdirectory â print | more

Best of luck
Suraj

Re: Directory is missing

mrk_1 — Wed, 24 Sep 2008 10:15:35 GMT

Hi,
I could not find out those directorys. The directory contains the installable files for MQ application.

So, I took back of those directory from other server and checked in current server. Its working fine.

How do I check who deleted those directorys. Is there any command?

Thank you.

Re: Directory is missing

Suraj K Sankari — Wed, 24 Sep 2008 10:24:30 GMT

Hi,

If auditing is enable then you can do very easy way other wise you have to go users home directory and grep rm in .sh_history this may help you.
# grep rm .sh_history

Suraj

Re: Directory is missing

V. Nyga — Wed, 24 Sep 2008 10:50:05 GMT

Hi,

check also the permissions of the directory in which the lost directory was.
Change permissions, so no user can delete files or sub-directories.
You can also check the Trash-directories of your users.
It's in /.dt/Trash.
Well, with the find command from '/' these directories will be checked too.

Do a 'grep rm /*/.sh_hist*'
so the first '*' is for all users.

Volkmar

Re: Directory is missing

mrk_1 — Wed, 24 Sep 2008 16:58:56 GMT

Thank you all.
I could see the directory was deleted by some one. found that using the command 'grep rm /*/.sh_hist*

Thanks,
Ram

Re: Directory is missing

Kenan Erdey — Wed, 24 Sep 2008 17:28:57 GMT

and after deleting perhaps tried to delete his log, you said last command isn't working.

Re: Directory is missing

Gokul Chandola — Thu, 25 Sep 2008 02:12:06 GMT

Hi,
Congrets for recovered Valuable Data and Putting Point as per you accessment also.

Regards,
Gokul Chandola

Re: Directory is missing

Dennis Handly — Thu, 25 Sep 2008 04:05:54 GMT

>I could see the directory was deleted by some one.

If the directory that contains that directory isn't modified that often you can use "ll -d parent-directory" to see the time of last deletion/addition.