System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

Query regarding abandoned files seen in HP-UX

AL_3001
Regular Advisor

Query regarding abandoned files seen in HP-UX

Hello Gurus,

I need to clear my understanding about abandoned files. I first want to understand, What are abandoned file and why does this happen? Secondly, how to prevent this to happen.

I have an example to make this a bit more useful.. See the attached text file.

My question is, what does the id 3836 in the place of file owner signify? Becozuse there is no user in /etc/passwd as 3836.

Next question, how to prevent this from happening.

If anyone has more question, please ask me. I need to resolve this issue.

Thank You.

Regards,
Ashish
8 REPLIES
Ivan Krastev
Honored Contributor

Re: Query regarding abandoned files seen in HP-UX

Look in older backups of /etc/passwd file for user with id 3836.

regards,
ivan
Pete Randall
Outstanding Contributor

Re: Query regarding abandoned files seen in HP-UX

The user who used to correspond to uid 3836 has been removed from /etc/passwd but the files owned by this user were left behind, that is why use 3836 as the owner. You can use the find command to clean them out: find /home /tmp /var/tmp -user 3836 |xargs rm -rf

The way to prevent this is to clean out the files when the user is removed.


Pete

Pete
Michael Mike Reaser
Valued Contributor

Re: Query regarding abandoned files seen in HP-UX

This can occur when files are moved from one system to another via tar or another archiver. The user 3836 was the numeric user ID who owned the files on the other system, but when the files are restored on your system the "3836" is shown by ls and ll because that's the information in the files' directory entries. If you had a username assigned to 3836 on your system, that username would show up instead of 3836.

In other words, these files may not be "abandoned", rather they were never "adopted" in the first place by a real user on your system.
There's no place like 127.0.0.1

HP-Server-Literate since 1979
Pete Randall
Outstanding Contributor

Re: Query regarding abandoned files seen in HP-UX

"why you see 3836", not "why use 3836". Sorry.

Pete
T G Manikandan
Honored Contributor

Re: Query regarding abandoned files seen in HP-UX

you need to check the backup for the /etc/passwd to see which user was assigned this userid.

It is always recommended to remove the user directory files when removing the users

#userdel -r
Steven E. Protter
Exalted Contributor

Re: Query regarding abandoned files seen in HP-UX

Shalom,

I would not consider these files abandoned.

Here is how it could happen.

HP-UX system is integrated into Windows ADS domain. User has rights and writes a file.

Server is booted from the domain, removed, or user is deleted in the domain controller. Suddenly files without owners.

You can even make it happen localy.

Create a user named charles, log on as him, write a couple of files, then delete the user. The files can be left behind and appear to be owner less.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
Bill Hassell
Honored Contributor

Re: Query regarding abandoned files seen in HP-UX

There is no concept of an abandoned file in Unix. 100% of all user IDs associated with a file are numbers. The /etc/passwd file provides a user-friendly translation for processes such as ls -l so you don't have to remember that a particular filed owned by 364 is associated with a user login name.

Created files are associated (by default) to the current user's number and stored that way in the directory. Just like /etc/hosts which associates a long IP address with one or more computer names, /etc/passwd is used to translate the number to a user login ID. You can change any file (with appropriate permissions) to any number in the UID range, like this:

touch /tmp/uid_test
ll /tmp/uid_test
chown 12345 /tmp/uid_test
ll /tmp/uid_test
rm -i /tmp/uid_test

AS you can see, you can change the ownership of a file or directory to any number. Whether this number corresponds to a user ID in your /etc/passwd file is not checked, nor should it be. If you need the file, assign the file to the proper owner.


Bill Hassell, sysadmin
AL_3001
Regular Advisor

Re: Query regarding abandoned files seen in HP-UX

Thanks a lot.