[CentOS] Random files in homedir gets deleted

[William L. Maltby]

On Thu, 2008-01-03 at 13:09 +0100, Christopher Thorjussen wrote:
> On one of my systems I seem to loose a file or two from time to time.
> Last night, one of my files (/home/online/sh/NattjobbPrivat.sh) was
> deleted/removed/vanished. Another time it was /home/online/sh/daemon
> that was deleted.
> 
> But I can't seem to find anything strange in the logs or in the history,
> nor would any of my scripts running in crontab mess with those files.
> 
> Where can I look for clues? And how do I enable audit for file
> operations in my home folder?

Although less common than "In The Day", if file system corruption was
repaired by *fsck during boot or other times, the "lost+found" directory
of the affected FS may contain some files with weird names, having
mostly numbers. These numbers are i-node numbers associated with the
"chunks" that appear in the lost+found directory.

If you see these, it indicates that corruption occurred and was
repaired. If the files are plain text, there is a possibility to
reconstruct the original files via visual inspection and concatenation.
Often they are mixed or binary and more difficult to reconstruct.

If it's not corruption, finding the cause may not be so easy. Long ago,
before the we had the plethora of tools now available, I found the cause
of such a mystery with a multi-pronged approach.

1. Fire up the system accounting package (sar).
2. Start a "daemon" (really just a "nohup <your shell script name> &"
   that checked for the existence of the file every so many seconds.
   This if really nothing more than a

       if [ ! -r <file name> ] ; then <some commands> ; fi

   The "-r" can be replaced/compounded with other flags as desired. See
   "man bash", "CONDITIONAL EXPRESSIONS.

   When the file went missing, a "log" entry was generated.

3. Generate the sar reports and examine them to see what was running
   around that time.

4. As I did, go viciously beat the offending user that made a flawed
   script about the ears with a rather rigid clue bat.

5. Problem solved.

> 
> 
> /Christopher Thorjussen
> <snip sig stuff>

HTH
-- 
Bill