HP-UX

The following files were wiped out - new empty files were left in their place.

/etc/inittab, /etc/inetd.conf, and /etc/MANPATH

The system is running HP-UX 11i v3 - Mar08.

Anyone seen anything like this?

Any ideas on a way to figure this out if it happens again or a suggested way to prevent and/or detect it.

I know I can make good copies and set up a cron job to monitor the files, but I am not sure how I might detect the cause of the problem.

Thanks!

Ken

Is it possible that someone was running SAM and it got clobbered while trying to write out?

I would hope SAM works a bit more cleanly, but I will glance back through the log (if its still there) to see if anything was going on at the time.

Can you check to see if the ownership/permissions were changed on these files?
What is the likelihood that someone was running a script that might have inadvertently mangled these files? Can you check the date/time stamp on these files?

I cannot check any of those things. The files had to be restored to bring the system back up. BTW, there is no SAM log because this is 11.31, so no SAM.

The date/time is available from one file but that does not really tell me anything at this point.

I was under the impression that, while deprecated, SAM was still available...

Knowing the date/time that the file was cleared should help you to pinpoint when the corruption took place. I'd recommend going through your cron and at logs, etc. to see if something was running at the time that the files were cleared.

You could search all file systems mounted on the host for scripts that might have included the words "inittab", "inetd.conf" and "MANPATH". Once you have the list of possible hits - check to see if any of them had the syntax to clear the files.

You should also check your authlog to see if someone (or some script) initiated a connection at that time, and repeat the search there.

The doc says SAM is deprecated, but it is actually no longer available. The command takes you to SMH.

What is authlog?

Any chance you can provide a command sequence for searching the filesystems for scripts referencing the strings in question? I have some ideas but since I'm very new to UNIX script writing, it would take me some time to create it.

Thanks for all the suggestions!