System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

Time suddenly set to midnight!

SOLVED
Go to solution
Brad Marks
Super Advisor

Time suddenly set to midnight!

OS: HP-UX 11.i
Yesterday afternoon the system time suddenly set itself to midnight. Fortunately this was caught rather quickly and not a lot of bad data was written.
How could this have happened? I've checked syslog which shows:

Dec 10 16:01:26 fki su: + trf x.axb-root
Dec 10 00:01:37 fki xntpd[2239]: synchronisation lost
Dec 10 00:19:59 fki su: + t1 x.axb-root
Dec 10 16:59:20 fki su: + t1 x.axb-root
Dec 10 18:20:12 fki xntpd[2239]: synchronized to 216.218.254.202, stratum=1

(User x.axb reset the time at around 4:58p.m.)

Does anyone know where I can find any clues as to how/why this happened?
There are only about eight users on the system that have root privileges, and seven of them work in IT.

I would really like to understand what happened. If anyone can point me in a direction, I would appreciate it (and probably assign points!).
Thanks,
Brad
It's not impossible -- it'll just cost more...
9 REPLIES
Jean-Luc Oudart
Honored Contributor

Re: Time suddenly set to midnight!

With 8 people, you surely can ask the question.

Also, a non IT with root privileges !!!!

track back x.axb user


Regards
Jean-Luc
fiat lux
Brad Marks
Super Advisor

Re: Time suddenly set to midnight!

Nobody wants to admit making a mistake.
Any means of seeing who & when did this in some kind of log?

Yes, one exceedingly trustworthy non-IT user with root privileges.

-Brad
It's not impossible -- it'll just cost more...
Fabian Briseño
Esteemed Contributor

Re: Time suddenly set to midnight!

Hello Brad.
I don't know if this will help but try:
last -R |more

That will tell you logon times maybe there you can check who was looged on when the time change occured.


Knowledge is power.
Jean-Luc Oudart
Honored Contributor

Re: Time suddenly set to midnight!

what is this user x.axb ?

can you track it back to some real user ?

Jean-Luc
fiat lux
Brad Marks
Super Advisor

Re: Time suddenly set to midnight!

Fabian; We have close to 400 users, so knowing who was logged on at the time won't help much.

Jean-Luc: What do you mean by 'track it back' to a user? I've asked all with root access if they executed something like a "date 0000" command with no confessions.

date 0000 would be the only means of setting the time to 0000, right? Further, if someone did this, wouldn't they have been asked "do you really want to run time backwards?[yes/no]", and wouldn't they have to have entered either "no" or "yes"?
Is there some other means of resetting the time?
Could my system have had some bizarre hick-up?
Thanks,
Brad
It's not impossible -- it'll just cost more...
Jean-Luc Oudart
Honored Contributor

Re: Time suddenly set to midnight!

Do you need to su to have access to root user from your terminal ? Or is this limited to the console ? hence who did su around that time ?
Have they all access the console ?

Just narrow down possibilities.

Rgds
Jean-Luc
fiat lux
Brad Marks
Super Advisor

Re: Time suddenly set to midnight!

Not limited to console, but anyone with root permissions can execute a Unix command (e.g. 'date 0000') from within our application software, thus no .history entry...

I'm still wondering if this could have happened without a user doing anything???
It's not impossible -- it'll just cost more...
Pete Randall
Outstanding Contributor
Solution

Re: Time suddenly set to midnight!

Brad,

The thing that bothers me most about this is that you're running NTP, so the only way this could be done (at least as far as I can imagine) is for someone to have done it deliberately. That means that one of your 8 (way too many, by the way) people with root access is not as trustworthy as you may have thought. The only other possibility is that they managed to do it by mistake without realizing it - unlikely in my opinion.

Without specifying a log file for NTP, all log messages go to syslog so you've already seen everything there is to see.


Pete

Pete
Brad Marks
Super Advisor

Re: Time suddenly set to midnight!

I'm going to chalk it up to too many 'roots' and not enough forthright co-workers!

Thanks all for your help.

Brad
It's not impossible -- it'll just cost more...