UNIX for Dummies Questions & Answers

Good Day!

I would like to ask, is there a way to find out the list of users or scripts that executed a umask command for a given time? Our server has been having issues about files being written with 000 access, and we need to find out if it's because someone or some code is playing around with umask.

Any kind of help would be appreciated.

Simple, for example: I would want to find out the process id, and user who executes the "w" command.

1. By default

Code:

w output

2. move the w to w.org

Code:

mv /usr/bin/w /usr/bin/w.org

3. Write your own w

Dont worry, it is simple.

Code:

#!/bin/sh

echo "Process ID: $$";
echo "Login Name: $LOGNAME";

/usr/bin/w.org

This will print the required information, and then calls the original w.

4. Thus how you can do it.
You need to redirect the output to a log file, if need be and analyze it.

Hope i had given enough way to troubleshoot your issue.

The method proposed by "thegeek" will not work for "umask" unless it is called as /usr/bin/umask. The "umask" command is built into all the main shells on HP-UX.

Further to your previous thread:

Unix File has 000 access when written

Have you checked the kernel parameters? Particularly any to do with maximum number of open files or maximum number of file locks. I have seen files on HP-UX with permissions 000 after a program died silently due to exceeding a kernel parameter.
Some key kernel parameters visible in "sar" (look for figures in the ov=overflow columns), but HP "glance" is better.

Code:

sar -v

I would add:
What makes you think it has something to do with umask and not chmod? (Ive seen developers do so with chmod...)

I thought that was so, because for all instances of the 000 access (there have been four within 2 months), it happened exactly after the file was written, disabling all other future reads to it. The process that writes those files are completely automatic, so I am doubtful that someone had perfect timing to execute chmod just exactly when the file was written.


Thanks, I will look more into the sar command, as it is my first time to hear about it. Do you mean that you saw a 000 file after a program died after exceeding a kernel parameter, and that program was writing the file? Or could it possibly be another program that died, and affected the writing of another program?