disappearing file

[Tony Kuehn]

I have a couple of HPUX 11.i boxes each have a copy of a application script. periodically this script "disappears". The scripts disappears from all servers within ~10 minutes of each other. Working with the application team I have not found any cron jobs or other "scheduled task" that would be doing this. Does anyone have any suggestions for how I could "watch" this file with a script and alert when it disappears?? Ideally, I would like to be able to tell who/what "touched" the file before it disappeared. I have experimented with a continuous loop running lsof have not been able to get information about who removes the file.
Please advise, any info/help you may have. Thanks!!!!

[Mark Grant]

Create another script that starts your script. This first script should trap SIGCHLD and then go to sleep. Immediately the child script dies, your starter script will wake up and you can get it to alert you.

It can then check out the system for you.

Another option is to grep through every users shell history to see who is doing stuff with your script.

[Dietmar Konermann]

You could use the auditing subsystem to track all file deletions (event type "delete"). Unfortunately you need to convert to a "Trusted System" before.

Have a look at e.g. http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/5187-2216/5187-2216_top.html&con=/hpux/onlinedocs/5187-2216/00/00/72-con.html&toc=/hpux/onlinedocs/5187-2216/00/00/72-toc.html&searchterms=auditing&queryid=20040617-065635 and consider yourself is this could be a way for you to go.

Best regards...
Dietmar.

[Tony Kuehn]

Mark - when you say have a starter script do you mean a script that kicks of the "disappearing script" or the lsof script that I am trying to watch the file with?

Also, another admin has looked through the history files and wasn't able to find anything that seemed relavant. (maybe I should double check just in case?)

[Geoff Wild · Accepted solution]

What are the permissions of the file?

Try setting it to 500...

Maybe look into locking the file:

http://www.ecst.csuchico.edu/~beej/guide/ipc/flock.html

Rgds...Geoff

[Mark Grant]

The "starter" script would be used to start you disappearing script. It's just a good way of monitoring an application or script without all those "ps -ef | grep blah blah"'s going on. It would allow you to immediately get your starter script to issue a "who" and perhaps a "ps" and a few other things too. Just so you can see what is happening on the machine at the time the script dies.

On the other hand, it's of no use for monitoring if just the script file itself disappears which, looking at it again, is probably what you want.

[Tony Kuehn]

Dietmar - I like that idea, however, we don't have Trusted Systems enabled. :( Maybe this would be a case to push for enabling trusted systems!

Geoff - Thanks for the document on file locks. I am going to look into this to see if it could be incorporated to watch the file in question.