Find command and -xdev

[LinuAIX]

Greetings,

I use the find command to feed the backup command to accomplish a system backup. The example would be:

find /usr \
/var \
/home \
/ -xdev|backup -ivqf /dev/rmt0

The -xdev is supposed to find everything in / that is within the hd4 filesystem. It is not supposed to find /tmp as an example. This has work this way for a long time. Suddenly my backups began to fail because it wanted a second tape volume and I have no logic in the script to deal with this. The reason it is requesting the second volume all of the sudden is that the find command is feeding it the name of filesystems outside of /. Has anyone else found this behavior and if so how the heck have you gotten around it. Or is this a new flaw in the find command?

Larry Bennett
Senior Systems Programmer
Ecolab, Inc.

 

[RodKnowlton]

Technically it's not feeding it the name of filesystems, it's feeding the name of directories in root that happen to be mount points for filesystems.

Give a directory, back-by-name (backup's -i option) only backs up the directory, not the files within the directory.

What's "df -k /usr /var /home /" look like, and what's the capacity of rmt0?

- Rod


IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+

Wish you could view posts with a fixed font? Got Firefox & Greasemonkey? Give yourself the option.

 

[LinuAIX]

Hi Ron,

Thnaks for the feed back. Now I am really confussed as to what the heck is not working correctly. I fully get what you mean about find seeing the mount point and my backup command with the i doing a backbyname and thus just backing you the representation of the dir and not going into the content. I still do not understand why -xdev is not stopping the crom FS find from going on. Here is the information:

IN GB
/dev/hd2 10.00 2.83 72% 131779 6% /usr
/dev/hd1 2.38 0.40 84% 29984 5% /home
/dev/hd9var 0.26 0.18 31% 1728 3% /var
/dev/hd4 0.06 0.03 55% 3514 11% /

The tape drive is a 8MM Mammoth which is 20/40GB.

 

[RodKnowlton]

Well, if find suddenly started behaving differently, find is different.

Some possibilities:

Was there any system software maintenance done right before the change in behaviour?
---------

There could be a new find in the script's path. Modify the script by inserting:

which find
exit

right before the find, then run it under the same login it's cron'ed under. What you want to see is [tt]/usr/bin/find[/tt] or [tt]/bin/find[/tt].
---------

One ugly possibility is that someone has installed a rootkit on your machine. find is one of the system utilities that a rootkit needs to trojan to prevent its detection.

Run "[tt]lppchk -c -m 3 bos.rte.commands[/tt]" and see if anything shows up. Of course, this won't help if lppchk has also been trojaned.

- Rod

IBM Certified Advanced Technical Expert pSeries and AIX 5L
CompTIA Linux+
CompTIA Security+

Wish you could view posts with a fixed font? Got Firefox & Greasemonkey? Give yourself the option.