Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Chriss Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
file creation
- Thread starter ac325ci
- Start date
No, in a ufs file system, the file information is kept in a structure called an inode. There's nothing in the inode to record what process created it.
It does record the userid and groupid of the process that created it, and you might be able to approximate what created it with history files, but that doesn't guarantee you've got the correct process.
The otherway would be if you kept repeatedly running lsof and caught the process in the act.
Otherwise no.
Why are you trying to find out? That may trigger other ideas.
It does record the userid and groupid of the process that created it, and you might be able to approximate what created it with history files, but that doesn't guarantee you've got the correct process.
The otherway would be if you kept repeatedly running lsof and caught the process in the act.
Otherwise no.
Why are you trying to find out? That may trigger other ideas.
- Thread starter
- #3
KenCunningham
Technical User
Is there anything in cron that writes to the file (if you mean 'every so often').
- Thread starter
- #5
What is the owner userid of the file?
If the create or last modification date of the file is always the same time each day, look at that userid's crontab. It's probably a cron job.
If you think it's someone that's logged on and running something, type "[tt]last[/tt]" and see who might have been logged on at that time.
If the file always has the same name, or at least a predictable name, create a file with that name and change the permissions on it to "000" ([tt]chmod 000 filename[/tt]). Then wait to see if something fails. This is kind of a shot in the dark since you may not see a failure message.
You could look for which file (program or script) had the filename in it. Say the file is called "[tt]mystery.file[/tt]", try something like this...
This hasn't been tested, so I'm sure it's not quite correct, but you get the idea.
Can you tell us the name of the file? And the directory it's in? Maybe it's a known file.
If the create or last modification date of the file is always the same time each day, look at that userid's crontab. It's probably a cron job.
If you think it's someone that's logged on and running something, type "[tt]last[/tt]" and see who might have been logged on at that time.
If the file always has the same name, or at least a predictable name, create a file with that name and change the permissions on it to "000" ([tt]chmod 000 filename[/tt]). Then wait to see if something fails. This is kind of a shot in the dark since you may not see a failure message.
You could look for which file (program or script) had the filename in it. Say the file is called "[tt]mystery.file[/tt]", try something like this...
Code:
find / -type f -exec fgrep mystery.file {} \; 2>/dev/null
# or maybe
find / -type f -print -exec strings {} \; | egrep '^/|mystery.file' > hunt.logCan you tell us the name of the file? And the directory it's in? Maybe it's a known file.
- Thread starter
- #7
- Status
Similar threads
- Locked
- Question