Is it possible to find out how/when/who deleted particular dierectory on UNIX Aix3 Post: 51186

Sponsored Content

Top Forums UNIX for Dummies Questions & Answers Is it possible to find out how/when/who deleted particular dierectory on UNIX Aix3 Post 51186 by Perderabo on Wednesday 12th of May 2004 10:29:18 PM

05-12-2004

Administrator Emeritus

Yow! First of all, you can do "ps -fu <uid>" to get a list of process for a certain user. But even with that revision, I would certainly not run that script. Especially for root. I don't know AIX, but there are processes like swapper and init that are special. I wouldn't try a ptrace() on them without a lot of research.

Can you briefly unplug the system from the network? If the directory disappears while the box is unplugged from the network, you know that it's a local process. If the directory is exported via NFS or a similiar service the local box may be invoking a rmdir() or unlink(). Even without NFS, a cronjob on another system could use a remote shell. Unplugging the system for a a few carefully timed seconds will tell you if another box is involved.

Deleting a directory requires write permission to the parent directory. By varying the permissions on that parent, you should be able to nail down the uid involved.

I would do a "ps -fu <uid>" in a loop around 4:00, sending the results to a file. Then I would study the file looking for any commands that could delete the directory.

Most directories are deleted by program like rm or rmdir. Or maybe perl. For that to happen, the program must run. To run a program, you must read it. This updates atime in the inode. Run "ls -lu /usr/bin/rm" at 3:59 and 4:01. If the time doesn't change, that was not the program used.

With a little detective work, you can usually zero in on the culprit.

Perderabo

View Public Profile for Perderabo

Find all posts by Perderabo

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

lost or deleted data in Unix?

Quote: "Until the space is used for another file, it is not deleted and the data can be recovered (although it may require jumping through hoops)." Unquote I know this is true in the Windows world, but I didn't think it was true of Unix. I had always been told once it was deleted in Unix, it...

2. UNIX for Dummies Questions & Answers

Help comparing 2 files to find deleted records

Hi, I need to compare todays file to yesterdays file to find deletes. I cannot use comm -23 file.old file.new. Because each record may have a small change in it but is not really a delete. I have two delimited files. the first field in each file is static. All other fields may change. I...

3. UNIX for Dummies Questions & Answers

is it possible to check logs in UNIX who deleted the files?

Hello, is it possible to check logs in UNIX who deleted the files? Is there logs in UNIX besides .sh_history?

4. UNIX for Advanced & Expert Users

Unix ID deleted - What happen to process

I have an unix id (AIX system) which is used to run a couple of processes. They also write some log files into a file system (that is not in the home directory of the user id, but in different location). One bad day, the id was deleted accidentally. But the home directory, files and everything...

5. UNIX for Dummies Questions & Answers

recover deleted file in unix

hi after using rm command how to recover the deleted file

6. UNIX for Dummies Questions & Answers

how to recover deleted files in unix

Hi Experts, by mistake i deleted some files that are very important to the project. is there any way that i can recover those files,there is no backup for that but the details of the file we know. This will be a great help. Thanks

7. UNIX for Dummies Questions & Answers

Restoring back a deleted file in unix.

Hi, Can any one tell me how to restore back the deleted file in unix? I know the file name. If i know the inode number of the file does help more to restore back the file?

8. AIX

AIX emgr -l -u VUID command and differences from AIX3 to 6?

Hey, I currently only have access to an AIX 6.1 system with no interim fix information I.E. any emgr -l -u command results in the following: 'There is no efix data on this system' Could anyone provide me with valid output of a emgr -l -u VUID command when there IS efix data on a system for the...

9. UNIX for Dummies Questions & Answers

To find the Ip address of the user who deleted files

Hi, There were a few files deleted from a server by user xyz. The file names are:- /oraextME4/oradata/ME11G22/TEST_IMPORT_01.dbf /oraextME4/oradata/ME11G22/RKVITR1_03.dbf /oraextME4/oradata/ME11G22/TEST_IMPORT_02.dbf need to know the ip address of the terminal from which that...

10. UNIX for Advanced & Expert Users

How to list deleted files in UNIX?

Hi All, Its an interview question. I just want to know the answer of below question. 1) How to list deleted files in unix

LEARN ABOUT POSIX

pidof

PIDOF(8)						Linux System Administrator's Manual						  PIDOF(8)

NAME

       pidof -- find the process ID of a running program.

SYNOPSIS

       pidof [-s] [-c] [-n] [-x] [-o omitpid[,omitpid..]]  [-o omitpid[,omitpid..]..]  program [program..]

DESCRIPTION

       Pidof  finds  the  process  id's (pids) of the named programs. It prints those id's on the standard output. This program is on some systems
       used in run-level change scripts, especially when the system has a System-V like rc structure. In that case these scripts  are  located	in
       /etc/rc?.d, where ? is the runlevel. If the system has a start-stop-daemon (8) program that should be used instead.

OPTIONS

       -s     Single shot - this instructs the program to only return one pid.

       -c     Only  return  process ids that are running with the same root directory.	This option is ignored for non-root users, as they will be
	      unable to check the current root directory of processes they do not own.

       -n     Avoid stat(2) system function call on all binaries which are located on network based file systems like NFS.  Instead of using  this
	      option the the variable PIDOF_NETFS may be set and exported.

       -x     Scripts too - this causes the program to also return process id's of shells running the named scripts.

       -o omitpid
	      Tells  pidof  to omit processes with that process id. The special pid %PPID can be used to name the parent process of the pidof pro-
	      gram, in other words the calling shell or shell script.

EXIT STATUS

       0      At least one program was found with the requested name.

       1      No program was found with the requested name.

NOTES

       pidof is actually the same program as killall5; the program behaves according to the name under which it is called.

       When pidof is invoked with a full pathname to the program it should find the pid of, it is reasonably safe. Otherwise it is  possible  that
       it  returns  pids  of  running programs that happen to have the same name as the program you're after but are actually other programs. Note
       that that the executable name of running processes is calculated with readlink(2), so symbolic links to executables will also match.

SEE ALSO

       shutdown(8), init(8), halt(8), reboot(8), killall5(8)

AUTHOR

       Miquel van Smoorenburg, miquels@cistron.nl

								    01 Sep 1998 							  PIDOF(8)

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

lost or deleted data in Unix?

Discussion started by: wmosley2

2. UNIX for Dummies Questions & Answers

Help comparing 2 files to find deleted records

Discussion started by: eja

3. UNIX for Dummies Questions & Answers

is it possible to check logs in UNIX who deleted the files?

Discussion started by: james_falco

4. UNIX for Advanced & Expert Users

Unix ID deleted - What happen to process

Discussion started by: cmgreat