Solaris

Hi Everyone,

I see some peculier thing happening on my server. I have one zipped file created long back as a normal user and trying to remove it now. When i tried to remove as that particular user, i was not able to do that. So i logged in as a root user and removed that successfully. But it is re-creating again and again for every 2 or 3 days. Dont no what is wrong and where i need to check for that. I want to remove it permanently. Please Advice on this.

I am using the following command to remove it.

Code:

# rm -rf /name.tar.gz

have a look at your cron jobs.

Code:

crontab -l

Which user is owner of the file?

Considering the name of the file, I suppose a kind of backup script with buggy file name creation, maybe missing quotes around the filename.

Check what is the last modification time for this file.
You can then schedule a script that will do 'ps -ef' (or /usr/ucb/ps auxww) or ptree $(fuser yourfilename.tar.gz 2>/dev/null | paste -sd"\0" -) that you redirect into a log file at the time the tar and/or the tar and/or gzip process are supposed to run so this may help you to identify the script that generate it.

@Aqualung: There are no cronjobs wrt that particular file.

@ctsgnb: I have deleted that file for now, let me wait until it re-creates; to check the time stamp.

Till then awaiting for comments....

Assuming you are running Solaris 10 or newer, you can use dtrace to monitor what process is creating this file.

This script (eg: tracegz.d) should do it:

Code:

syscall::open:entry
{
     self->path = copyinstr(arg0);
}

syscall::open:return
/self->path == "/name.tar.gz"/
{
     printf("Tracked file open:");
     ustack();
}

run it with

Code:

dtrace -s /path_to/tracegz.d

Hi Jlliagre,

Thanks for your post. I am fresher for unix shell scripting, can you please advice me by explaining any modification required in that script you have posted ? I mean to ask, do i need to edit the following by giving any path.

Code:

self->path

And i believe i suppose to give the path where i copied the script for the following one, please correct me if i am wrong.

Code:

dtrace -s /path_to/tracegz.d

Be aware that this isn't a shell script but a dtrace one, i.e. using a programming language name D which is closer to C than the usual shell.
If you want to monitor a different file, you can replace "/name.tar.gz" by something like "/the/file/you/want.txt". The script could also be modified to have that file name passed as an argument. That's it. The -s option expects the dtrace script pathname (or just file name if in the same directory).