Directory is missing

[mrk_1]

Hi All,

Some of the important directory is missing on hp-ux box. As I am having a root privilege, How could find out who has deleted those folder?
And Is it possible to take back of this folder now?

Thanks.

[Ivan Krastev · Accepted solution]

Find what directories were deleted.
Check for latest backup and restore it or do a full restore from Ignite.

Check history file(s) for 'rm' commands.


regards,
ivan

[Kenan Erdey]

Hi,

if you know when it's deleted check logins with last -R and check IP's. if you have backup or ignite-backup you can recover. if these files are binaries, libraries etc you can copy files from an identical server.

Kenan.

[James R. Ferguson]

Ram:

> How could find out who has deleted those folder?

The word is "directory" in UNIX. You might examine any scripts that you recently modified. There are safe ways to code and their are unsafe ways. Of course, the damage may have been done at the command line. You could try examining your shell history.

> And Is it possible to take back of this folder now?

Without knowing what was deleted, the answer varies. Was it just a directory? (then recreate it). Was a directory and its files deleted? (then a good backup may be appropriate to restore (partially)). Does it really matter? (then maybe this is a good lesson).

UNIX (and LINUX) isn't that other operating system. There is no "recycle bin". UNIX is designed to do whatever you tell it to do without fuss.

Regards!

...JRF...

[MarkSyder]

There is another possibility: is one of your discs not available? What is the result of

ioscan -fnC disk

?

If you have a bad disc, I hope you have a good backup.

Mark Syder (like the drink but spelt different)

[sreekanthtm]

Permision is another factor, which can cause this issue. Are u sure, that you have root privilage. Please login as root and confirm it.


Which directory got deleted? Is it a system directory OR data? Check the history of commands, may be accidentally deleted the files or wrong command.

[mrk_1]

Thank you all for the quick response.

When I issue the command last -R, it response that, pid exceeds MAXPID: wtmp file corrupted.
I tried this in root user.

I remeber the folder name. Is not a system directory, Its a data only. But I dont know where I have to check the backup of this folder. I am not sure abt ignite backup.

Please help me out..

Thank you..

[Ganesan R]

Hi,

Have restore from last good backup is the only way to restore if it is really missing. If directories or deleted by some script then history also won't be able to provide the details.

Just to confirm ensure it is not NFS mount and unmounted by someone.

Thanks.

[MarkSyder]

If it's not a system directory it won't be on an ignite backup. What do you use for data backups? Data protector? Fbackup?

Mark

[OldSchool]

again, it's going to depend on the kind of data.

if it was part of a database structure, then your going to have to recover the db to the last consistent backup. if it was simply "storage space" for documents, then it might not matter at all.

if it was system config information, then it needs to come off a backup tape.

without information as to what was actually stored there, its all just a guess.

you *do* have backups, right?

[Suraj K Sankari]

Hi,

This type of problem is common where too many new users (who is new to unix) are there, Most of the time I found those missing directories are not removed from the system, those directory has been moved from their original location.
So better check with find command, I hope you will find those missing directory here is the command

#cd /
#find / -name missingdirectory â print | more

Best of luck
Suraj

[mrk_1]

Hi,
I could not find out those directorys. The directory contains the installable files for MQ application.

So, I took back of those directory from other server and checked in current server. Its working fine.

How do I check who deleted those directorys. Is there any command?

Thank you.

[Suraj K Sankari]

Hi,

If auditing is enable then you can do very easy way other wise you have to go users home directory and grep rm in .sh_history this may help you.
# grep rm .sh_history

Suraj

[V. Nyga]

Hi,

check also the permissions of the directory in which the lost directory was.
Change permissions, so no user can delete files or sub-directories.
You can also check the Trash-directories of your users.
It's in /.dt/Trash.
Well, with the find command from '/' these directories will be checked too.

Do a 'grep rm /*/.sh_hist*'
so the first '*' is for all users.

Volkmar

[mrk_1]

Thank you all.
I could see the directory was deleted by some one. found that using the command 'grep rm /*/.sh_hist*

Thanks,
Ram

[Kenan Erdey]

and after deleting perhaps tried to delete his log, you said last command isn't working.

[Gokul Chandola]

Hi,
Congrets for recovered Valuable Data and Putting Point as per you accessment also.

Regards,
Gokul Chandola

[Dennis Handly]

>I could see the directory was deleted by some one.

If the directory that contains that directory isn't modified that often you can use "ll -d parent-directory" to see the time of last deletion/addition.