make_recovery touches /etc/group?

[Stephanie L Davenport]

We have changed a couple things on our 10.x and 11.x machines for SOX compliance. The first was to set up a script that runs nightly that looks for date/time changes on specific files.
This past week, I also set up ignite to run on Saturday nights.
The problem is that every time I run make_recovery, the date/time stamp is changed. Is this normal? And, if so, is there some documentation showing this... so I can attach it with the docs I have to give the auditors?

Thanks!
Steph

[Robert-Jan Goossens]

Hi Steph,

You seem to use an old Ignite version, make_recovery has been replaced with make_tape_recovery. Have a look at below thread.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1211381694344+28353475&threadId=125532

Regards,
Robert-Jan

[James R. Ferguson]

Hi Steph:

I have to ask --- WHICH timestamp? --- mtime, ctime or atime?

# ls -l /etc/group #...evaulates mtime
# ls -ul /etc/group #...evaluates atime
# ls -cl /etc/group #...evaluates ctime

I would expect the last access timestamp (atime) to be changed by virtue of the fact that the file was copied, unless your use something like 'fbackup' (which doesn't apply here) but which does reset a file's lastaccess time after copying it (and hence changes the file's 'ctime').

Regards!

...JRF...

[Steven E. Protter]

Shalom,

touching the date and time stamp should not be significant.

If you can find the right disks, you might try make_tape_recovery on at least the 11.00 systems. It may behave differently.

SEP

[Scot Bean · Accepted solution]

Yes, depending on your version, and how you use it, routine Ignite recovery creation can relocate, then restore several files, including the sensitive /etc/group file. This could affect the time stamp.

Found this in the Ignite release notes:
* JAGag46564 fix. The make_sys_image command will no longer reset
the /etc/group and /etc/netgroup files back to the newconfig state
when the level is 2.

( from http://www.docs.hp.com/en/IUX/docs/release_note.pdf )

The fix to remove this was in a very recent version (Dec07). Your versions will be older, but are doing similar file manipulations.