Time suddenly set to midnight!

[Brad Marks]

OS: HP-UX 11.i
Yesterday afternoon the system time suddenly set itself to midnight. Fortunately this was caught rather quickly and not a lot of bad data was written.
How could this have happened? I've checked syslog which shows:

Dec 10 16:01:26 fki su: + trf x.axb-root
Dec 10 00:01:37 fki xntpd[2239]: synchronisation lost
Dec 10 00:19:59 fki su: + t1 x.axb-root
Dec 10 16:59:20 fki su: + t1 x.axb-root
Dec 10 18:20:12 fki xntpd[2239]: synchronized to 216.218.254.202, stratum=1

(User x.axb reset the time at around 4:58p.m.)

Does anyone know where I can find any clues as to how/why this happened?
There are only about eight users on the system that have root privileges, and seven of them work in IT.

I would really like to understand what happened. If anyone can point me in a direction, I would appreciate it (and probably assign points!).
Thanks,
Brad

[Jean-Luc Oudart]

With 8 people, you surely can ask the question.

Also, a non IT with root privileges !!!!

track back x.axb user


Regards
Jean-Luc

[Brad Marks]

Nobody wants to admit making a mistake.
Any means of seeing who & when did this in some kind of log?

Yes, one exceedingly trustworthy non-IT user with root privileges.

-Brad

[Fabian Briseño]

Hello Brad.
I don't know if this will help but try:
last -R |more

That will tell you logon times maybe there you can check who was looged on when the time change occured.

[Jean-Luc Oudart]

what is this user x.axb ?

can you track it back to some real user ?

Jean-Luc

[Brad Marks]

Fabian; We have close to 400 users, so knowing who was logged on at the time won't help much.

Jean-Luc: What do you mean by 'track it back' to a user? I've asked all with root access if they executed something like a "date 0000" command with no confessions.

date 0000 would be the only means of setting the time to 0000, right? Further, if someone did this, wouldn't they have been asked "do you really want to run time backwards?[yes/no]", and wouldn't they have to have entered either "no" or "yes"?
Is there some other means of resetting the time?
Could my system have had some bizarre hick-up?
Thanks,
Brad

[Jean-Luc Oudart]

Do you need to su to have access to root user from your terminal ? Or is this limited to the console ? hence who did su around that time ?
Have they all access the console ?

Just narrow down possibilities.

Rgds
Jean-Luc

[Brad Marks]

Not limited to console, but anyone with root permissions can execute a Unix command (e.g. 'date 0000') from within our application software, thus no .history entry...

I'm still wondering if this could have happened without a user doing anything???

[Pete Randall · Accepted solution]

Brad,

The thing that bothers me most about this is that you're running NTP, so the only way this could be done (at least as far as I can imagine) is for someone to have done it deliberately. That means that one of your 8 (way too many, by the way) people with root access is not as trustworthy as you may have thought. The only other possibility is that they managed to do it by mistake without realizing it - unlikely in my opinion.

Without specifying a log file for NTP, all log messages go to syslog so you've already seen everything there is to see.


Pete

[Brad Marks]

I'm going to chalk it up to too many 'roots' and not enough forthright co-workers!

Thanks all for your help.

Brad