Re: HELP - track deletion of a symbolic link

• Previous message: Barry Margolin: "Re: HELP - track deletion of a symbolic link"
• In reply to: Barry Margolin: "Re: HELP - track deletion of a symbolic link"
• Next in thread: Bodo Eggert: "Re: HELP - track deletion of a symbolic link"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: 3 Jun 2004 15:20:16 GMT

In article <barmar-5279AA.11134603062004@comcast.dca.giganews.com>,
Barry Margolin <barmar@alum.mit.edu> writes:
|> In article <6678e873.0406030703.661bf71d@posting.google.com>,
|> msabnis1@yahoo.com (Mukesh) wrote:
|>
|> > I have a symbolic link defined in our Unix system. But it gets deleted
|> > everyweek three or more time during the night. Is there anyway I can
|> > log/audit its deletion so that I can find out who is doing it?
|>
|> Some versions of Unix have file system auditing capabilities. Since you
|> haven't told us what type of Unix you're running, we can't tell whether
|> yours does or how to enable it.
|>
|> If it's happening on a regular basis, it's probably due to a cron job.
|> You could write a job that checks for its existence every 10 minutes,
|> which would narrow down the time when it's being deleted. Then you can
|> scan for cron jobs that run at that time.

A better way of doing that is to turn on system accounting, and
look through the account records for processes running at the
last update time of the directory containing the link. It might
be necessary to use your trick to identify exactly which update
was the relevant one.

Regards,
Nick Maclaren.

• Previous message: Barry Margolin: "Re: HELP - track deletion of a symbolic link"
• In reply to: Barry Margolin: "Re: HELP - track deletion of a symbolic link"
• Next in thread: Bodo Eggert: "Re: HELP - track deletion of a symbolic link"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]