Folder getting removed

[Sanjiv Sharma_1]

Hi,

Setup: N4000/HP-UX 11.00/Oracle 9i

I have a folder /opt/oracle/xxx/admin/yyy/tiger.

The folder tiger is getting removed quite often and we have to recreate it.

Only xxx user has write permission to the tiger folder. But xxx doesn't seems to run any cronjob or command to remove it. No information found in the .sh_history of xxx regarding the removal of tiger.

Is there a way to trace who (which user or any cronjob) is removing this folder?

Thank you,
Sanjiv

[Steven E. Protter]

Linux has a command called chattr

chattr +i /opt/oracle/xxx/admin/yyy/tiger

Nobody even root is going to remove it.

Might want to look into finding the source and compiling chattr on hpux. Or there may be an equivalent command that I don't know.

Beyond that either the user is doing it or root is via a cron job.

If you have cron jobs that clean up folders/files more than a certain number of days old this is a candidate for removal.

Its got to be cron and its probably a find +mtime job doing it.

All cron jobs have entries in the cron logs. If you could ascertain the time it happened, you can limit the amount of cron log entries you need to read.

see /var/adm/cron/log

SEP

[Sanjiv Sharma_1]

SEP,

I do have checked the /var/adm/cron/log but didn't find any cronjob which could have removed the folder /opt/oracle/xxx/admin/yyy/tiger.

[Animesh Chakraborty · Accepted solution]

Hi Sanjiv,
You must check the permissions of all the sub directories in the path.
What is the permission of your yyy directory ?
To isolate the problem, put sticky bit in the tiger directory.
chmod 1744 (whatever permission you want for others) /opt/oracle/xxx/admin/yyy/tiger
and monitor.

This will prevent removing the files by others under tiger directory.

Thanks
Animesh

[Sanjiv Sharma_1]

Some inputs. The folder is getting removed at about 00:22 am midnight everyday.

I am trying to figure out the cronjob which may be responsible for this.

[Cheryl Griffin]

Why don't you trace the rmdir command with a wrapper? Look at the following thread for Bill's wrapper scripts. You can leverage off of what he has supplied.

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=113459

[Mark Ellzey]

Sanjiv,

As Cheryl says, wrap up the rmdir command in a shell script. You may also want to do the same for the rm command, as whomever is doing the removing could be using 'rm -r', rather than 'rmdir'.

Regards,
Mark

[Bill Hassell]

As far as restricting a directory from getting removed, in Unix, the ability to remove a file (or a directory which is itself a file) has NOTHING to do with permissions of the file or directory. A file or directory with 000 permissions can be removed by anyone if the file/directory is under a directory with 777 permissions. So to restrict the removal of this directory, change the permissions of the parent directory. Since the directory is always removed at the same time, it is very likely a cron (or possible a repetitive at command or even a script that sleeps for 24 hours.

[Massimo Bianchi]

Is there any entry in the syslog.log for any user ?

Check also with the command "last", and check the logs for any user, entering at those hours..

Massimo

[Dave La Mar]

Sanjiv,
To add to what others have said...
We have on occasion found files removed by a third party application. This would, of course, mean you would have to have a third party application accessing this file.

Happy hunting.

Regards,

dl