• to detect process which deletes file - kernel 2.4.22

    From Raspone Favilndia@1:0/0 to All on Mon Sep 22 05:32:54 2014
    I have old server which is working in big company so it's hard to stop it.
    I'd like to find out what process is deleting some files.
    My kernel is 2.4.22-1.2199, too old!
    I' cannot use inotify but only dnotify but this is an older tool and it can't help me.
    I tried to install audit but all OS is too old and so there are are library dependencies and older repository are not updated. So this attempt was bad. What solutions do you suggest me please?

    --- MBSE BBS v1.0.4 (GNU/Linux-i386)
    * Origin: The Kofo System II BBS telnet://fido2.kofobbs.
  • From yamo'@110:300/11 to All on Mon Sep 22 18:43:50 2014
    Reply-To: yamo@beurdin.org

    Hi,

    Raspone Favilndia a ‚crit le 22/09/2014 07:32 :
    I have old server which is working in big company so it's hard to stop it. I'd like to find out what process is deleting some files.
    My kernel is 2.4.22-1.2199, too old!
    I' cannot use inotify but only dnotify but this is an older tool and it
    can't help me.
    I tried to install audit but all OS is too old and so there are are library
    dependencies and older repository are not updated. So this attempt was bad.
    What solutions do you suggest me please?


    Can you use lsof?



    --
    St‚phane <http://pasdenom.info/fortune/?>
    L'homme est un ˆtre raisonnable, mais les hommes le sont-ils ?
    -+- Raymond Aron, Dimensions de la conscience historique -+-

    --- MBSE BBS v1.0.4 (GNU/Linux-i386)
    * Origin: Serveur de salon (110:300/11@linuxnet)
  • From Scott Hemphill@1:0/0 to All on Mon Sep 22 20:31:44 2014
    Reply-To: hemphill@alumni.caltech.edu

    Raspone Favilndia <rickyleroy2011@gmail.com> writes:

    I have old server which is working in big company so it's hard to stop it. I'd like to find out what process is deleting some files.
    My kernel is 2.4.22-1.2199, too old!
    I' cannot use inotify but only dnotify but this is an older tool and it
    can't help me.
    I tried to install audit but all OS is too old and so there are are library
    dependencies and older repository are not updated. So this attempt was bad.
    What solutions do you suggest me please?

    I can't help with identifying the process, but you can stop files from
    being changed or deleted by setting the immutable attribute. (See "man chattr".)

    Scott
    --
    Scott Hemphill hemphill@alumni.caltech.edu
    "This isn't flying. This is falling, with style." -- Buzz Lightyear

    --- MBSE BBS v1.0.4 (GNU/Linux-i386)
    * Origin: The Kofo System II BBS telnet://fido2.kofobbs.