cancel
Showing results for 
Search instead for 
Did you mean: 

Directory is missing

SOLVED
Go to solution
mrk_1
Frequent Advisor

Directory is missing

Hi All,

Some of the important directory is missing on hp-ux box. As I am having a root privilege, How could find out who has deleted those folder?
And Is it possible to take back of this folder now?

Thanks.
17 REPLIES
Ivan Krastev
Honored Contributor
Solution

Re: Directory is missing

Find what directories were deleted.
Check for latest backup and restore it or do a full restore from Ignite.

Check history file(s) for 'rm' commands.


regards,
ivan
Kenan Erdey
Honored Contributor

Re: Directory is missing

Hi,

if you know when it's deleted check logins with last -R and check IP's. if you have backup or ignite-backup you can recover. if these files are binaries, libraries etc you can copy files from an identical server.

Kenan.
Computers have lots of memory but no imagination
James R. Ferguson
Acclaimed Contributor

Re: Directory is missing

Ram:

> How could find out who has deleted those folder?

The word is "directory" in UNIX. You might examine any scripts that you recently modified. There are safe ways to code and their are unsafe ways. Of course, the damage may have been done at the command line. You could try examining your shell history.

> And Is it possible to take back of this folder now?

Without knowing what was deleted, the answer varies. Was it just a directory? (then recreate it). Was a directory and its files deleted? (then a good backup may be appropriate to restore (partially)). Does it really matter? (then maybe this is a good lesson).

UNIX (and LINUX) isn't that other operating system. There is no "recycle bin". UNIX is designed to do whatever you tell it to do without fuss.

Regards!

...JRF...
MarkSyder
Honored Contributor

Re: Directory is missing

There is another possibility: is one of your discs not available? What is the result of

ioscan -fnC disk

?

If you have a bad disc, I hope you have a good backup.

Mark Syder (like the drink but spelt different)
The triumph of evil requires only that good men do nothing
sreekanthtm
Trusted Contributor

Re: Directory is missing

Permision is another factor, which can cause this issue. Are u sure, that you have root privilage. Please login as root and confirm it.


Which directory got deleted? Is it a system directory OR data? Check the history of commands, may be accidentally deleted the files or wrong command.
mrk_1
Frequent Advisor

Re: Directory is missing

Thank you all for the quick response.

When I issue the command last -R, it response that, pid exceeds MAXPID: wtmp file corrupted.
I tried this in root user.

I remeber the folder name. Is not a system directory, Its a data only. But I dont know where I have to check the backup of this folder. I am not sure abt ignite backup.

Please help me out..

Thank you..
Ganesan R
Honored Contributor

Re: Directory is missing

Hi,

Have restore from last good backup is the only way to restore if it is really missing. If directories or deleted by some script then history also won't be able to provide the details.

Just to confirm ensure it is not NFS mount and unmounted by someone.

Thanks.
Best wishes,

Ganesh.
MarkSyder
Honored Contributor

Re: Directory is missing

If it's not a system directory it won't be on an ignite backup. What do you use for data backups? Data protector? Fbackup?

Mark
The triumph of evil requires only that good men do nothing
OldSchool
Honored Contributor

Re: Directory is missing

again, it's going to depend on the kind of data.

if it was part of a database structure, then your going to have to recover the db to the last consistent backup. if it was simply "storage space" for documents, then it might not matter at all.

if it was system config information, then it needs to come off a backup tape.

without information as to what was actually stored there, its all just a guess.

you *do* have backups, right?
Suraj K Sankari
Honored Contributor

Re: Directory is missing

Hi,

This type of problem is common where too many new users (who is new to unix) are there, Most of the time I found those missing directories are not removed from the system, those directory has been moved from their original location.
So better check with find command, I hope you will find those missing directory here is the command

#cd /
#find / -name missingdirectory â print | more

Best of luck
Suraj

mrk_1
Frequent Advisor

Re: Directory is missing

Hi,
I could not find out those directorys. The directory contains the installable files for MQ application.

So, I took back of those directory from other server and checked in current server. Its working fine.

How do I check who deleted those directorys. Is there any command?

Thank you.
Suraj K Sankari
Honored Contributor

Re: Directory is missing

Hi,

If auditing is enable then you can do very easy way other wise you have to go users home directory and grep rm in .sh_history this may help you.
# grep rm .sh_history

Suraj
V. Nyga
Honored Contributor

Re: Directory is missing

Hi,

check also the permissions of the directory in which the lost directory was.
Change permissions, so no user can delete files or sub-directories.
You can also check the Trash-directories of your users.
It's in /.dt/Trash.
Well, with the find command from '/' these directories will be checked too.

Do a 'grep rm /*/.sh_hist*'
so the first '*' is for all users.

Volkmar
*** Say 'Thanks' with Kudos ***
mrk_1
Frequent Advisor

Re: Directory is missing

Thank you all.
I could see the directory was deleted by some one. found that using the command 'grep rm /*/.sh_hist*

Thanks,
Ram
Kenan Erdey
Honored Contributor

Re: Directory is missing

and after deleting perhaps tried to delete his log, you said last command isn't working.
Computers have lots of memory but no imagination
Gokul Chandola
Trusted Contributor

Re: Directory is missing

Hi,
Congrets for recovered Valuable Data and Putting Point as per you accessment also.

Regards,
Gokul Chandola
There is always some scope for improvment.
Dennis Handly
Acclaimed Contributor

Re: Directory is missing

>I could see the directory was deleted by some one.

If the directory that contains that directory isn't modified that often you can use "ll -d parent-directory" to see the time of last deletion/addition.