- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - HP-UX
- >
- Time suddenly set to midnight!
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-11-2009 08:52 AM
тАО12-11-2009 08:52 AM
Yesterday afternoon the system time suddenly set itself to midnight. Fortunately this was caught rather quickly and not a lot of bad data was written.
How could this have happened? I've checked syslog which shows:
Dec 10 16:01:26 fki su: + trf x.axb-root
Dec 10 00:01:37 fki xntpd[2239]: synchronisation lost
Dec 10 00:19:59 fki su: + t1 x.axb-root
Dec 10 16:59:20 fki su: + t1 x.axb-root
Dec 10 18:20:12 fki xntpd[2239]: synchronized to 216.218.254.202, stratum=1
(User x.axb reset the time at around 4:58p.m.)
Does anyone know where I can find any clues as to how/why this happened?
There are only about eight users on the system that have root privileges, and seven of them work in IT.
I would really like to understand what happened. If anyone can point me in a direction, I would appreciate it (and probably assign points!).
Thanks,
Brad
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-11-2009 09:19 AM
тАО12-11-2009 09:19 AM
Re: Time suddenly set to midnight!
Also, a non IT with root privileges !!!!
track back x.axb user
Regards
Jean-Luc
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-11-2009 09:38 AM
тАО12-11-2009 09:38 AM
Re: Time suddenly set to midnight!
Any means of seeing who & when did this in some kind of log?
Yes, one exceedingly trustworthy non-IT user with root privileges.
-Brad
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-11-2009 09:52 AM
тАО12-11-2009 09:52 AM
Re: Time suddenly set to midnight!
I don't know if this will help but try:
last -R |more
That will tell you logon times maybe there you can check who was looged on when the time change occured.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-11-2009 09:52 AM
тАО12-11-2009 09:52 AM
Re: Time suddenly set to midnight!
can you track it back to some real user ?
Jean-Luc
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-11-2009 10:04 AM
тАО12-11-2009 10:04 AM
Re: Time suddenly set to midnight!
Jean-Luc: What do you mean by 'track it back' to a user? I've asked all with root access if they executed something like a "date 0000" command with no confessions.
date 0000 would be the only means of setting the time to 0000, right? Further, if someone did this, wouldn't they have been asked "do you really want to run time backwards?[yes/no]", and wouldn't they have to have entered either "no" or "yes"?
Is there some other means of resetting the time?
Could my system have had some bizarre hick-up?
Thanks,
Brad
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-11-2009 10:08 AM
тАО12-11-2009 10:08 AM
Re: Time suddenly set to midnight!
Have they all access the console ?
Just narrow down possibilities.
Rgds
Jean-Luc
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-11-2009 10:31 AM
тАО12-11-2009 10:31 AM
Re: Time suddenly set to midnight!
I'm still wondering if this could have happened without a user doing anything???
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-11-2009 11:29 AM
тАО12-11-2009 11:29 AM
SolutionThe thing that bothers me most about this is that you're running NTP, so the only way this could be done (at least as far as I can imagine) is for someone to have done it deliberately. That means that one of your 8 (way too many, by the way) people with root access is not as trustworthy as you may have thought. The only other possibility is that they managed to do it by mistake without realizing it - unlikely in my opinion.
Without specifying a log file for NTP, all log messages go to syslog so you've already seen everything there is to see.
Pete
Pete
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО12-11-2009 11:54 AM
тАО12-11-2009 11:54 AM
Re: Time suddenly set to midnight!
Thanks all for your help.
Brad