Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
urgent : files missing
- Thread starter DoubleH
- Start date
DoubleH,
people will be very glad to assist you with your problem if you could provide just a little more info than that. You don't need to revail anything that will be of security issue to your environment. However, the forum need something like, what happened that led to the file(s) missing; do regular users have delete permision to that file(s)? etc, just be as detailed as you are politiclly allowed to.
FYI: if it's that urgent you may want to start looking for your last good backup tapes ...hopefully you have one.
goodluck. ^^^^^^^^^^^^^^^^^^^^^^^^^^
Experience is the Best Teacher
But its' cost is Heavy!
^^^^^^^^^^^^^^^^^^^^^^^^^^
people will be very glad to assist you with your problem if you could provide just a little more info than that. You don't need to revail anything that will be of security issue to your environment. However, the forum need something like, what happened that led to the file(s) missing; do regular users have delete permision to that file(s)? etc, just be as detailed as you are politiclly allowed to.
FYI: if it's that urgent you may want to start looking for your last good backup tapes ...hopefully you have one.
goodluck. ^^^^^^^^^^^^^^^^^^^^^^^^^^
Experience is the Best Teacher
But its' cost is Heavy!
^^^^^^^^^^^^^^^^^^^^^^^^^^
- Thread starter
- #4
Hi,
Regular users do not have write on that directory. Only root can do that. For examples some files are missing from /opt/local/bin in which only root can log in. Some other directories(like weblogic directories) are also missing for which the users have write access. But I checked the .sh_history and came to know that no one has done any remove operation explicitly. The root's history is disabled. So, I am not able to investigate on it.
Could anyone tell me a possible reason for this.
Thanks,
Double H Thanks & Regards,
DoubleH
Regular users do not have write on that directory. Only root can do that. For examples some files are missing from /opt/local/bin in which only root can log in. Some other directories(like weblogic directories) are also missing for which the users have write access. But I checked the .sh_history and came to know that no one has done any remove operation explicitly. The root's history is disabled. So, I am not able to investigate on it.
Could anyone tell me a possible reason for this.
Thanks,
Double H Thanks & Regards,
DoubleH
DoubleH,
Like every other thing in computer, especially unix, there could be thousand and one reasons that may have caused the sudden file disappearance, that include but not limited to user error and malicious code being introduced purposely or mistakenly. Haven't said that, you need to roleup your sleeves and pull out your good old investigative skill and start combing your entire file system/utility scripts.
1) You can start with the crontab ( crontab -l ) , make sure there are no strange entry you did not put-in or not aware of. Or a possible typographical error that may have pointed a well intended clean-up script to a wrong dir - such as the "/opt/loca/bin"
2) Check each of the scripts listed by the crontab -l to ensure none is deleting a wrong file
3) Check your file system for sudden unexplainable increase in size, that could indicate a possible attack.
My guess it that you must have check your dmesg (/var/adm/messages) , if not you may want to do that first, it could hold the missing link to the mistery.
I hope this and other contributions from other members of the forum will help you in unraveling the mistery.
goodluck. ^^^^^^^^^^^^^^^^^^^^^^^^^^
Experience is the Best Teacher
But its' cost is Heavy!
^^^^^^^^^^^^^^^^^^^^^^^^^^
Like every other thing in computer, especially unix, there could be thousand and one reasons that may have caused the sudden file disappearance, that include but not limited to user error and malicious code being introduced purposely or mistakenly. Haven't said that, you need to roleup your sleeves and pull out your good old investigative skill and start combing your entire file system/utility scripts.
1) You can start with the crontab ( crontab -l ) , make sure there are no strange entry you did not put-in or not aware of. Or a possible typographical error that may have pointed a well intended clean-up script to a wrong dir - such as the "/opt/loca/bin"
2) Check each of the scripts listed by the crontab -l to ensure none is deleting a wrong file
3) Check your file system for sudden unexplainable increase in size, that could indicate a possible attack.
My guess it that you must have check your dmesg (/var/adm/messages) , if not you may want to do that first, it could hold the missing link to the mistery.
I hope this and other contributions from other members of the forum will help you in unraveling the mistery.
goodluck. ^^^^^^^^^^^^^^^^^^^^^^^^^^
Experience is the Best Teacher
But its' cost is Heavy!
^^^^^^^^^^^^^^^^^^^^^^^^^^
- Status
Similar threads
- Locked
- Question