Re: [CentOS] Random files in homedir gets deleted

2008-01-25 Thread Fajar Priyanto
On Friday 04 January 2008 17:18:25 Radu Radutiu wrote: Hi you can try to use the kernel audit facility: 1) enable the auditd daemon: service auditd start 2) enable audit for the home directory (only audit write operations to the directory inode); the command is not recursive and you cannot

RE: [CentOS] Random files in homedir gets deleted

2008-01-04 Thread Christopher Thorjussen
On Thu, 3 Jan 2008 13:09:11 +0100 Christopher Thorjussen [EMAIL PROTECTED] wrote: On one of my systems I seem to loose a file or two from time to time. Where can I look for clues? Is your system visible to the internet? Maybe it's running some kind of Apache with homedirs loosely enabled and

RE: [CentOS] Random files in homedir gets deleted

2008-01-04 Thread Christopher Thorjussen
Where can I look for clues? And how do I enable audit for file operations in my home folder? If your system is capable, use the SMART tools to check your drive out (as CM suggests), something like this: smartctl -a /dev/sda replace /dev/sda with the drive in question See

RE: [CentOS] Random files in homedir gets deleted

2008-01-04 Thread Christopher Thorjussen
On Thursday 03 January 2008 19:09:11 Christopher Thorjussen wrote: On one of my systems I seem to loose a file or two from time to time. Last night, one of my files (/home/online/sh/NattjobbPrivat.sh) was deleted/removed/vanished. Another time it was /home/online/sh/daemon that was

RE: [CentOS] Random files in homedir gets deleted

2008-01-04 Thread Christopher Thorjussen
You can enable auditing to determine if the files are disappearing due to human/machine intervention (audit file system deletes) or if it is due to file system corruption (files disappear and no delete audits recorded). It may just be an errant rsync script. -Ross How do I enable auditing

Re: [CentOS] Random files in homedir gets deleted

2008-01-04 Thread Radu Radutiu
Hi you can try to use the kernel audit facility: 1) enable the auditd daemon: service auditd start 2) enable audit for the home directory (only audit write operations to the directory inode); the command is not recursive and you cannot use wildcards auditctl -w /home/user -pw 3) after a file

[CentOS] Random files in homedir gets deleted

2008-01-03 Thread Christopher Thorjussen
On one of my systems I seem to loose a file or two from time to time. Last night, one of my files (/home/online/sh/NattjobbPrivat.sh) was deleted/removed/vanished. Another time it was /home/online/sh/daemon that was deleted. But I can't seem to find anything strange in the logs or in the history,

Re: [CentOS] Random files in homedir gets deleted

2008-01-03 Thread CM
On Thu, 3 Jan 2008 13:09:11 +0100 Christopher Thorjussen [EMAIL PROTECTED] wrote: On one of my systems I seem to loose a file or two from time to time. Where can I look for clues? Is your system visible to the internet? Maybe it's running some kind of Apache with homedirs loosely enabled and

Re: [CentOS] Random files in homedir gets deleted

2008-01-03 Thread Ross S. W. Walker
- From: [EMAIL PROTECTED] [EMAIL PROTECTED] To: centos@centos.org centos@centos.org Sent: Thu Jan 03 07:09:11 2008 Subject: [CentOS] Random files in homedir gets deleted On one of my systems I seem to loose a file or two from time to time. Last night, one of my files (/home/online/sh

RE: [CentOS] Random files in homedir gets deleted

2008-01-03 Thread mike.redan
On one of my systems I seem to loose a file or two from time to time. Last night, one of my files (/home/online/sh/NattjobbPrivat.sh) was deleted/removed/vanished. Another time it was /home/online/sh/daemon that was deleted. But I can't seem to find anything strange in the logs or in

Re: [CentOS] Random files in homedir gets deleted

2008-01-03 Thread Fajar Priyanto
On Thursday 03 January 2008 19:09:11 Christopher Thorjussen wrote: On one of my systems I seem to loose a file or two from time to time. Last night, one of my files (/home/online/sh/NattjobbPrivat.sh) was deleted/removed/vanished. Another time it was /home/online/sh/daemon that was deleted.