Shell Programming and Scripting

This is why whenever I run rm -rf from a script, my first run is ALWAYS:

Code:

...
#rm -rf $something
echo "we will be removing: $something"
...

i.e. initially comment out the rm and have it echo what we'll be removing instead. If it looks sane, then go ahead and uncomment the rm.

Another lesson here - backups - but you have probably heard enough about that already...

In post #1 it says "most of my files in /usr got deleted", not a few. I assumed you perhaps had interrupted the script in the process..

But the script would have ran only a few times,probably less than ten,before I noticed the files missing.So how come more than 300 files were deleted from /usr/bin alone and some directories in /usr were removed altogether.

How many files were left in /usr/bin ? Is it possible that some files were (re-)installed in /usr/bin after a previous removal? Then the script could have been run with the current directory set to /usr, since it was trying to remove the oldest entry, even directory trees not just files...

I had nothing to with the execution of the script,it was executed by audomon daemon.

I don't think it would have reinstalled anything,because I don't think any provsion exists to do so.
Only bin,lbin,sbin and lib were present in /usr after deletion took place and most files were missing from them too.In /usr/bin I think only 4 files were left.I think they were view,remsh and other two startin with 'r'.

Anyone who runs a script as root which deletes files is asking for trouble.

So, when the OP asks "what went wrong?", the answer is pretty straight forward.

The OP ran a script that removes files (as the superuser!) without testing the script first. It's that simple.

How do you test it?

Well, when the script runs, instead of removing the files, you simply write the files that would be deleted to a file. Then, you examine the file with the output of "files and directories that would have been deleted" and make sure the script does what you want. If all is OK, then enable the script to actually work (delete the files).

Never, ever, run a script that deletes files (especially as root) without testing first and confirming the script is working as intended.

Edit: Note that ZB recommends a similar approach in his reply above.

I was not suggesting that the script might have reinstalled anything, but enquiring about the possibility that somebody else of some other process could have been installing or reinstalling something in /usr/bin after the script had previously removed the directory (perhaps even as a response to it, for example some form of configuration management)