well, I came in today to a raft of messages that users couldn't email from UNIX (HP-UX B.11.23 U i64)

/etc/mail/sendmail.cf was missing - just GONE from the directory. Other files were there.
mail was successfully sent at 19:48 last night and unsuccessful at 00:10. At least those are times are are sure about.

So, I thought I'd look in the mail.log.
/var/adm/syslog -- both syslog.log and mail.log had been reset to 0 at 22:17 and 22:18 respectively.

No one with root passwd admits to doing anything, nor would they do anything.

what the heck might have happened ... how can I find out if there is anything else ... how can I explain this ... how can I prevent this ... etc.

I have restored /etc/mail/sendmail.cf from a backup and mail is now working.
But nothing of the outbound mail is showing in /var/adm/syslog/mail.log
it is still:

It looks like (probably) an sftp user/process signed on and dropped a file in the root filesystem that caused it to fill from ~80% to 100%
our monitoring service was alerted and deleted the file - but not before we got a core dropped in / root directory. Definitely something dropped a file there.

Still not clear what made the sendmail.cf file disappear though - the tech that cleaned up the file also trimmed the logs while he was on but nothing about /etc/mail/sendmail.cf

so that is still a mystery to be solved.

The core file has been sent to HP to see what they can make of it.

The file command
will tell you the name of the app that dropped the core file.

thanks. We've unfortunately moved it off the server already, but good to know for the future. I can see that the file was owned by root though.

how can I tell what user accounts might have access to drop files at all in the root directory?

just to record the resolution/root cause

OVO (open view monitoring) dropped a core file in the root file system, filling it to 100%
our monitoring company got the 100% alarm and the tech made some room in root - and also looked for files in vg00 that could be deleted and inadvertantly deleted /etc/mail/sendmail.cf

apparently there was also a sendmail.cf-orig and he got them both.