Filesystem question

[Pete Nesbitt]

On July 15, 2004 01:41 pm, robbrown27709 at comcast.net wrote:
> I have a user who claims he did the following:
> cp -r /u02/stuff  /u102
> cd  /u102/stuff
> rm *
> cd /u102
> rmdir stuff
> He claims that the stuff directory was removed from both /u02 & /u102. I
> tried to recreate this, but every time I do, it works correctly; only
> /u102/stuff is removed & /u02/stuff is intact. This guy is a very reputable
> DBA and everyone believes him. I am the Unix admin & I must explain this to
> the boss. I can't explain this. I have never seen anything like this. Is
> this possible? Any thoughts or comments? The following is the config:
> /dev/cciss/c1d0p12   /u02
> /dev/cciss/c1d1p2    /u102
> Thanks in advance for any comments.
> -Robert Brown


Hi,
I agree with looking at the history file, but you need to know that it can be 
misleading.
First, although it would not likely come into play here, when multiple logins 
or teminals are run for a single user, the history file will vary between 
terminals because it is written when you close that shell.

Also, you can uparrow and overwrite a history item.

O condider if someone was more interested in saving face than in resolving 
what really happened, they could do something like this:

pete at nebula temp$ history|grep [x]yz
pete at nebula temp$ touch xyz
pete at nebula temp$ history|grep [x]yz
  199  touch xyz
pete at nebula temp$ rm xyz
pete at nebula temp$ history|grep [x]yz
  199  touch xyz
  201  rm xyz
pete at nebula temp$ history -d 201
pete at nebula temp$ history|grep [x]yz
  199  touch xyz
pete at nebula temp$


so maybe include a:
history|grep "history -d"
-- 
Pete Nesbitt, rhce