Re: HELP - track deletion of a symbolic link

From: Thomas Vincent (thomasv_at_mac.com)
Date: 06/06/04

  • Next message: Keg: "Re: Detecting hacking attempts - what should browsers *not* request?" 
    Date: 6 Jun 2004 14:05:24 -0700

    msabnis1@yahoo.com (Mukesh) wrote in message news:<6678e873.0406030703.661bf71d@posting.google.com>...
    > Hello Guys,
    >
    > I have a symbolic link defined in our Unix system. But it gets deleted
    > everyweek three or more time during the night. Is there anyway I can
    > log/audit its deletion so that I can find out who is doing it?
    >
    > I will appreciate your help in this.
    >
    > Cheers.

    Depending on what UNIX you are using, look into enabling C2 logging
    capabilities. While the Orange book C2 standard has been replaced by
    the Common Criteria set of standards and policies most vendors will
    refer to it as C2 in the manual.
    Otherwise you might look into either writing a shell script that
    replaces the rm binary and records who is executing the command if you
    think it is a actual user or a person.
    Another solution is to run a cron job that monitors the symlink then
    when it finds that it has dissapeared. Capturing the ps -ef or -aux
    output to see who the likely culprit might be.
    If this is a commercial UNIX then you might call support, and they
    MIGHT give you a library that could monitor any calls to replace that
    symlink.

    Cheers,
    Tom Vincent
    http://www.ipwrangler.com

  • Next message: Keg: "Re: Detecting hacking attempts - what should browsers *not* request?"

    Relevant Pages

    • Re: Linux Sys Calls - int 80h
      ... >> the C calling conventions ... > implementation detail, which will vary from system to system, as ... wrapping this in a convenient form to the original UNIX C calls... ... parties) as an "agreed" _standard_ between parties to follow... ...
      (alt.lang.asm)
    • Re: Rewriting and predictions
      ... not led to any improvements worth porting. ... then you claim others would rewrite it into standard Forth, ... I thought they could run some sort of Unix ... But I expect Win32Forth will become WForth (the name WinForth ...
      (comp.lang.forth)
    • Re: Alpha remembrance day
      ... project, Alpha the soup to nuts "Industry Standard" 64 bit processor, ... switching to TCPIP when the later replaced OSI as the "internetworking" ... VMS didn't. ... UNIX Server/Workstation. ...
      (comp.os.vms)
    • Re: mkdir() wont do it for me
      ... C standard apart from the odd bug. ... just accepting mkdir() as a fact of a "C" programmer's ... but only because I fished it out of the trash of "Unix house" I ... there are networking groups. ...
      (comp.lang.c)
    • Re: How did C++ beat the competition?
      ... >>The fact that most of the big players have abandoned it for Java. ... >>I KNOW the Unix creators did. ... J2EE programmers? ... standard; any more than J2EE belonged in the Java Standard. ...
      (comp.lang.cpp)
    • Quantcast