ln -s links disappearing!!!

[Dan Rosen]

OK, I am praying that there is a system misconfiguration, and not a security hole. BUT, I have two symbolic links, one for sar data and one for ps data. If you use sarcheck, you know what I mean.

I have cronjobs that are exporting data to files within those directories throughout the day. Every few days, the symbolic link disappears! My crontab starts complaining, and I will find the link missing.

Has anyone experience something similar? Or, if not, what is the best way to monitor the link I setup to see who is messing with it? (i.e. honeypot)

TIA - Dan

[Joseph C. Denman]

Hmmm.....??? Sounds fishy

Can you isolate it to a certain time?

Is the link owned by root?

You could right a script to check info when the link disappears???

Something like:

until [ ! -h /your/link ]
do
echo "test" > /dev/null
done
fuser -c /filesystem/of/link > /var/tmp/link.log
ps -ef >> /var/tmp/link.log
who >> /var/tmp/link.log


Don't know. I have also seen programs that try to clean up after themselves and remove the links and create directories. If the links are owned by root, I would also check with the other SAs that know the password.

...jcd...

[Deshpande Prashant]

Hi Dan
Did you find anything so far?
I also have seen this twice so far on my system.
This is my guess-
I also have softlink to /var/adm/sa dir and every mid-night the cron (/usr/lib/sa/sa2) runs to generates the sar reports and also deleted files older than 30 days in /var/adm/sa directoty. I guess this is what deleting the link. I have modified the sa2 file to search in the actual directory instead of soft-link place(/var/adm/sa)

See if it helps.

Thanks.
Prashant Deshpande.