file date changes during fbackup

[Starrynight_1]

Hello all

There is a strange thing happening in my system. There is a tar file (owned by root) that has a diferent date everyday, the same date (and time) when an fbackup was made during the night...
For me, this is very strange, first because I don??t know who created this file and second because the night backup it??s not made with tar.
Clue: the backup is made with fbackup, to tape (DLT7000) and by a user with root privileges but that as only access to a menu.

Any help would be good.

Thanks

SN

[A. Clay Stephenson]

This is almost certainly a backup scheduled by cron. Examine your crontab entries and I think your mystery will be solved.

[T. M. Louah]

..check cron jobs with "crontab -l "
root:> crontab -l

[Kenny Chau]

Hi,

Try this:

# crontab -l | grep tar

to see if anyone set the tar job at the cron list.

Hope this helps.
Kenny.

[Michael Tully]

Hi,

If these suggestions don't find it, you
will need to go through the various scripts
that run from cron and look for the tar
backup(s) that way.

Michael

[Starrynight_1]

Hi everybody

Looking in crontab was the fisrt thing I??ve done. That is not where the problem is.
Thank you anyway.
Any other sugestions?

SN

[Steven Sim Kok Leong]

Hi,

Note the creation time of the tar file. Run a scheduled cron job that runs a few minutes after the regular tar file creation to capture the following to aid diagnostics:

#!/sbin/sh
LOGFILE=/tmp/tar.txt

touch $LOGFILE
ps -fae >> $LOGFILE
netstat -a >> $LOGFILE
who >> $LOGFILE
last -10 >> $LOGFILE
elm -s"[TRACE] unknown tar" < $LOGFILE

Hope this helps. Regards.

Steven Sim Kok Leong

[Steven Sim Kok Leong]

Hi,

Remember to specify your_email_address:

elm -s"[TRACE] unknown tar" your_email_address < $LOGFILE

This minimises the chance that the culprit tries to remove your log file.

Hope this helps. Regards.

Steven Sim Kok Leong