find command not working correctly

[Mike Ingram_1]

Hi All,

I noticed that the /usr/tmp directory was deleted - this is a link to /var/tmp. I eventually found that a cron job was deleting it.
The cron job was simply "find /usr/tmp -mtime +1 -exec rm {} \;"
Not only was the /usr/tmp directory deleted but also the files in the directory were not deleted as expected.
The only way I could get this to work properly was to do the find command against the "base" directory (/var/tmp) instead.

So my question is simply, is this normal behaviour or is there a bug in the system. I am running HP-UX 11.23

Thanks.

[Arunvijai_4]

Hi Mike,

/var/tmp is required for some applications to work properly. So, dont attempt to delete it.

-Arun

[RAC_1]

The command is fine. It should delete files in /var/tmp that have mtime more than a day old. What exactly was deleted and what not?

[Mike Ingram_1]

Hi RAC,

As I said originally, the command "find /usr/tmp -mtime +1 -exec rm {} \;" deletes the /usr/tmp link and does not delete the files in the directory.
But if I run the command "find /var/tmp -mtime +1 -exec rm {} \;", it works correctly.
/usr/tmp is standard on 11.23 and is a link to /var/tmp

Cheers.

[RAC_1]

I think you need to add -follow to find command. It will follow a link then.
man find for details.

[Mike Ingram_1]

Hi RAC,

I'll check it out and update later.

Thanks.

[Darrel Louis]

Mike

What happens if you add the option
"-type f" to your command.

Darrel

[Mike Ingram_1]

Hi Darrel,

I haven't tried!!
All I tried was changing the /usr/tmp to /var/tmp in the find command and it worked correctly.

Cheers

[Mike Ingram_1]

Hi,

I tried the "-type l" and "-follow" args to the find command and it makes no difference.
The link directory is removed and therefore the files in the directory are left behind.

Is this a bug or am I doing something stupid?
Has anyone else had this problem?

Cheers.

[RAC_1]

I tested it on 11.23 and had no problems.
My setup is as follows.
/usr/tmp link to /var/tmp which is again a link to /tmp
I used following command.
find /usr/tmp -follow -mtime +1
What exact command you are using now?

[Mike Ingram_1]

Hi RAC,

If I run the command "find /usr/tmp -follow -mtime +1" it displays correctly.
The problem is when I run the command "find /usr/tmp -follow -mtime +1 -exec rm {} \;".
It deletes the /usr/tmp directory!!

Cheers.

[RAC_1]

What if you add -type f

[Patrick Wallek]

You probably really should add a '-type f' (that is 'f' as in 'f'ile) to your command. That way it won't delete the link.

find /usr/tmp -type f -follow -mtime +1 -exec rm {} \;

[Mike Ingram_1]

Thanks Patrick,

Your command certainly doesn't delete the /usr/tmp directory, but unfortunately it also doesn't delete any matching files in the directory.
If I use your command, and change the /usr/tmp to /var/tmp, then the matching files in the directory do get deleted.

The "catch" lies in the fact that the directory /usr/tmp is a link to /var/tmp.

Cheers.

[RAC_1]

Is /var/tmp link to /tmp?

[Mike Ingram_1]

Hi RAC,

No, /var/tmp is a directory "on it's own" - not a link.

[root@lando:/var]# ls -l | grep tmp
drwxrwxrwt 6 root root 8192 Apr 13 14:05 tmp

[root@lando:/usr]# ls -l | grep tmp
lrwxrwxrwt 1 root sys 8 Feb 24 14:06 tmp -> /var/tmp

Cheers.

[RAC_1]

also, how about ading -depth to find command?

find /usr/tmp -depth -follow -mtime +1

[Arturo Galbiati]

Hi Mike,
try adding / at the end of the dire name:
find /usr/tmp/ -mtime +1 -exec rm {} \;

in this way find should remove the file in the directory and not the link

HTH,
Art

[Mike Ingram_1]

Hi Art,

No, that didn't make any difference!
Same results - /usr/tmp directory deleted.

Cheers.

[Patrick Wallek · Accepted solution]

Well, my solution would be to use the correct directory name. Since /usr/tmp is a link to /var/tmp, just use /var/tmp in the find command.

I believe /usr/tmp is a "transition link", which means it was originally provided for compatibility reasons in the HP-UX 9.x to HP-UX 10.x transition. Since it is a transition link , anything referencing /usr/tmp really should be changed to /var/tmp. Why? Because it is entirely possible that at some point in time all the transition links will go away.

They have been around since HP-UX 10.x came out, one would hope that most people have started using the new directory layouts by now.

By the way, you can get a list of all 'transition links' on your system with the '/opt/upgrade/bin/tllist' command.

[James R. Ferguson]

Hi Mike:

Patrick is correct. Using:

# find /usr/tmp -type f -follow -mtime +1 -exec rm {} \;

...should "follow" the symbolic link to '/var/tmp', and find only *files* (not directories nor symbolic links).

Are you doing this command from your interactive shell? Do you perchance have 'rm' aliased to include '-r' ? What does this show>

# whence rm

Regards!

...JRF...

[Bill Hassell]

It is really important to understand tghat /usr/tmp is NOT a directory. Just like /bin and /lib, they DO NOT exist on HP-UX and haven't for the last 10 years. If you type the command:

ll -d /usr/tmp /bin /lib

you will not see anyu directory, you will see a transition link. This is a red flag (and has been for a decade) that the filesystem layout corresponds to V.4 filesystem names and layouts. The red flag means that you need to learn the correct names of the directories because in a future release of HP-UX, the transition links may be optional and eventually removed completely. All scripts and programs that use /usr/tmp should be edited to use the correct name.

Yes, there are different flavors of Unix as far as filesystem layout is concerned but the V.4 standard has been around for a long time and code (as well as sysadmin thinking) needs to change. A symbolic link is a special feature of Unix with specific limitations (see ln(1) man page):

"-s Cause ln to create symbolic links instead of the usual hard links. A symbolic link contains the name of the file to which it is linked. The referenced file is used when an open() operation is performed on the link (see open(2)). A stat() on a symbolic link returns the linked-to file; an lstat() must be performed to obtain information about the link (see stat(2)). A readlink() call can be used to read the contents of the symbolic link (see readlink(2)). Symbolic links may span file systems and refer to directories."

So symlinks require special handling. Rather than try to workaround the limitations of a temporary link, I would use the correct directory name. The utilities for managing transition links are tlinstall and tlremove and are located in /opt/upgrade/bin.

[Bill Hassell]

And from the 11i v2 release notes:

"The â Upgradeâ product which contains the transition links management tools will be removed from the next HP-UX release. The transition links (tlinks) management tools were intended to be temporary transition tools for application migration from HP-UX 9.x to HP-UX 10.x file system layout. The following transition links management tools are being deprecated and will become obsolete in post-HP-UX 11i v2 releases:

* tlinstall
* tllist
* tlremove"

from:
http://docs.hp.com/en/5990-6737/ch08s06.html

Note the Unix'y word "deprecated"

[Mike Ingram_1]

Hi James,
Many thanks - your suggestion worked 100%

Hi Bill,
Thanks for your information.
I had the exact same problem with /usr/mike which was simply a symbolic link to /var/mike, as shown below:
[root@lando:/usr]# ls -l
lrwxr-xr-x 1 root sys 9 Apr 14 00:00 mike -> /var/mike

It is very frustrating having to remove files from a link directory in a different way to a regular directory!! This is not unique to HP - I had the same issue on Solaris.

Thanks to all who contributed to this problem.