BSD

Very strange.... is the / home directory nfs shared (or mounted) elsewhere? is it subject to access by any other system (for backup purposes etc) that could possibly be changing permissions.

I'm thinking along the similar lines or un-tarring source code where the user/groupid is numerical because the source user doesn't exist on the local system. does the userid "192382" in your example exist on another system?

just stabbing in the dark here...

Hi Celtic,

Thanks for the response and sorry for my lack of response, I was pretty busy the rest of the week. I have dug deeper into this and while there are "repository servers" there are no trace of any user management system/scripts and there is also no trace of any strange jobs.

I am closing in on the "periodic daily" as the likely culprit. I have set some monitoring up which sounds an alert at pretty much the same time as periodic daily runs

Code:

1       3       *       *       *       root    periodic daily

I'm probably going to have to dissect the /etc/periodic/daily stuff to try to find evidence for this (or either just uncomment periodic for a day or two and see if the permissions behave). According to man periodic it just executes shell scripts in /etc/periodic/daily|weekly|monthly|security.