I need help figuring out why I lose /usr/bin directory sometimes it goes down 3-4 times a day and I have to link them back using ln - /usr/bin bin I cannot figure out why this is happenning

Why are you linking to the /usr/bin directory ... and where??

We are not linking to it or should I say our backoffice system does. I had IBM look at it and our software vendor. They only tell me that someone or program according to the logs is deleting the links. No one as of yet can tell me why or how to stop it...

What do you mean "linking" to it???

I should correct myself I don't if the backoffice system is linking to it or not. I just know that something is deleting the /usr/bin and don't know why

check the filemon utility, or write a script that checks if the directory is still there in periodic intervals, and write to a logfile with timestamp

then you have the specific time


I would check first:

1. automated process on the machine, per cron perhaps
check every users crontab (crontab -l) that has the rights to delete the folder, and check for user created scripts running

2. automated process outside the machine
triggered per ssh, telnet, rsh...
you can compare the time from your scripts logfile I wrote above with the login logs on your server an find out the IP (last, syslog)

3. manually triggered by a user, but seems not very likely
like step 2, analyse login logs for that


very scary

I still don't get how something is deleting /usr/bin ! 1. Hoes does it "reappear"? 2. When it's deleted, can you still run commands?