AIX

Then it is the "/bin" directory that keeps disappearing?

Yes that is the one...

Please copy/paste (within code tags or as a TXT attachment) the following commands:

Code:

ps -ef
find /var/spool/cron/crontabs -ls

The first is to get the entire process list. The second shows all files that are used by cron.

AIX 5.3 (and perhaps earlier) has an audit feature, which allows you to record the process and/or command that changes, for instance, a particular file. You can read about that at Setting up auditing

Ok, this makes more sense, because /bin is a link to /usr/bin on AIX systems.

EDIT: Setting up auditing is a good idea, otheus.

bakunin

Thanks for your response but I have ran the auditing process with IBM support and send them the logs. The only thing they told me is that something is going out and deleting the links. They thought it was a job being launch by the user root. However they can't tell what the job is and how it is deleting the links. I have cahnged the root password three different times per their recommendation still having the issue.

First, the output of ps and find please. Then we'll get to auditing if it's needed

Ok what do you need from the ps? Just what's running?