Shell Programming and Scripting

Hi

I have the following code which was supposed to clean up a directory when the number of files in that directory exeeded 2.The code is given below.

Code:

 
#!/usr/bin/ksh
dir_num=`/usr/bin/find /var/.audit -type d | /usr/bin/wc -l`
if [ $dir_num -gt 2 ]
then
 oldest_file=`/usr/bin/ls -1t | /usr/bin/tail -1`
 /usr/bin/rm -rf $oldest_file
fi

When executed the above code something bad happened.Apparantly most of my files in

Code:

/usr

directory got deleted.Can anyone tell me how it happened?

I have the modified code:

Code:

 
 
#!/usr/bin/ksh
dir_num=`/usr/bin/find /var/.audit -type d | /usr/bin/wc -l`
if [ $dir_num -gt 2 ]
then
 oldest_file=`/usr/bin/ls -1t /var/.audit/ | /usr/bin/tail -1`
 /usr/bin/rm -rf /var/.audit/$oldest_file
fi

Is there any way to recover those file?

Thanks in advance...

Yes, you can recover from your system backup.

You see,I don't have a backup.What I'm doing now is copying all those files from another server with the same configuration.

Is there any other way?

---------- Post updated at 09:03 AM ---------- Previous update was at 09:00 AM ----------

What I really want to know is how it happened.How did all those files got deleted in ther first place?

Yikes. Difficult to say without knowing what find found, but a path name with spaces in it may cause unintended splitting whenever unquoted. /path/with /usr/ would split into '/path/with' and '/usr/' for instance.

Why this script was running as root is another good soul-searching question. Preventing program bugs from getting too out of control is one reason file permissions exist, but root bypasses all that.

You were using find to get a list of all .audit files in /var, but after that, you ran ls in the working directory that may have been pointing to somewhere else (i.e. to /usr?), got the oldest file there and rmed it with the -force option. Anyhow, it should have removed just one file, unless you ran it repeatedly to remove nearly the entire /usr dir.

Your second code snippet is far safer here...

$oldest_file could also have contained a directory entry. Maybe the script was executed while in the root directory and /usr happened to be the oldest entry..

Well find was intented to return a number;initially 2 and then 3 on the next run,but never more than 3.

And another intresting fact is that the $oldeest_file sholud only have the filename and not any path.
The script was supposed to be automatically executed by the audomon daemon when the audit trail was swiched to another file.So I have no idead fom where the script was run,but I think the script would hav run with a UID of 0 and thus all the problem.

---------- Post updated at 01:41 AM ---------- Previous update was at 01:37 AM ----------

If that was the case, then all files in /usr should have been deleted.But some files were not deleted,only a few.