topic Re: Script to trouble shoot. in Operating System - HP-UX

Script to trouble shoot.

brian_31 — Tue, 23 Jul 2002 15:19:33 GMT

Hi Team:

Trying to put up a small script which would help in trouble shooting. Say a particular application launches itself fine on one box but not on the other.I need to find all the files it touches upon before it comes up on one box and it may not touch up that file on the other. Here is something i thought..

touch file1
echo please wait....
sleep 15 (you can change this depending on the timeframe you require)
touch file2
find / -newer file1 ! -newer file2
echo completed

Can someone think better please..

Thanks
Brian.

Re: Script to trouble shoot.

Rodney Hills — Tue, 23 Jul 2002 15:58:11 GMT

Trying to find files used by an application is a challenge-

Using "find / -newer ..." is good to see what files have been modified, but doesn't show those files that were only read. The use of file2 shouldn't be needed if you execute the find right after the application terminates.

Two products that can follow a process as files are opened are "glance" and "lsof". Unfortunatelly these are only snapshot views as the process runs.

Another possibility is if you have already configured your system as a "trusted system", their are tools to track all file access events. If you are not a "trusted system", don't jump into it lightly. Their are other ramifications that I consider negative to going to a trusted system.

Hope this helps...

-- Rod Hills

Re: Script to trouble shoot.

brian_31 — Tue, 23 Jul 2002 16:07:00 GMT

Hi:

True. It track only the files that have been modified, but is there a way that we could track the files that have been read also?

Thanks
Brian.

Re: Script to trouble shoot.

Volker Borowski — Tue, 23 Jul 2002 18:23:12 GMT

Should work,

try "-anewer" a=accessed

Volker

Ref: http://www.nsa.gov/selinux/doc/man/find.1.html

Re: Script to trouble shoot.

Wodisch_1 — Tue, 23 Jul 2002 18:40:15 GMT

Hi Brian,

convert your system to "trusted" and then "audit" the file access for everybody (or only some users).

HTH,
Wodisch

Re: Script to trouble shoot.

brian_31 — Wed, 24 Jul 2002 14:15:07 GMT

Hi:
Thanks. so this should work and also print out the files that were read...

touch file1
echo please wait....
sleep 15 (you can change this depending on the timeframe you require)
touch file2
find / -anewer file1 ! -anewer file2
echo completed

is this correct?

Please advise.

Thanks
Brian.

Re: Script to trouble shoot.

Peter Kloetgen — Wed, 24 Jul 2002 14:21:18 GMT

Hi Brian,

i would do the following find command:

find / -anewer file1 -a ! -anewer file2

the -a option is the logical operator for a "and" operation.

Allways stay on the bright side of life!

Peter