Originally posted by: Tibor_B

Hi,

lately I noticed that on two of our servers we have plenty of files in /usr/bin with no permissions, like:

----------   1 root     system        25518  4 okt 2007  capture ----------   1 bin      bin          159766  4 okt 2007  curt ----------   1 root     system        73506  5 feb 2007  dig ----------   1 bin      bin            8884  5 feb 2007  emstat ----------   1 root     system       215536 14 mar 2007  fdpr ----------   1 root     system        63732  5 feb 2007  filemon ----------   1 root     system        23218 21 jan 2007  fileplace

I dont know how long has this been like this. The system was lately upgraded from 52-TL09 to 52-TL10 (yes, it is unsupported and so on...). It seems this causes no problems.

Do you have any idea how this had happened?

Thanks
#AIX-Forum

Originally posted by: Tibor_B

Additional info:

I found in the meantime, that when I list content of bff package like this:

$restore -qavTf 194.bff New volume on 194.bff: Cluster size is 51200 bytes (100 blocks). The volume number is 1. The backup date is: Mon Apr 21 00:49:56 DFT 2008 Files are backed up by name. The user is BUILD. 755  bin      bin                 0 ./  555  root     system           2667 ./lpp_name 755  bin      bin                 0 ./usr 755  bin      bin                 0 ./usr/lpp 755  bin      bin                 0 ./usr/lpp/bos.acct/bos.acct/5.2.0.106 555  root     system          18186 ./usr/lpp/bos.acct/bos.acct/5.2.0.106/liblpp.a 4555  root     bin             30218 ./usr/bin/iostat 4555  root     bin             28340 ./usr/bin/vmstat 4555  root     bin             28788 ./usr/bin/vmstat64 4550  root     adm             14804 ./usr/lib/sa/sadc 555  bin      bin             56646 ./usr/sbin/sar 555  root     adm             24740 ./usr/sbin/acct/acctcom 4550  root     adm             22654 ./usr/sbin/diskusg 550  root     adm              5174 ./usr/sbin/acct/acctdusg 550  root adm              3574 ./usr/sbin/acct/acctcon2 550  root     adm             12418 ./usr/sbin/acct/acctprc1 550  root     adm              3203 ./usr/sbin/acct/prdaily 2555  bin      adm              8284 ./usr/bin/timex 550  root     adm             19325 ./usr/sbin/acct/runacct 550  root     adm             16100 ./usr/sbin/acct/acctcon1 The total size is 295121 bytes. The number of archived files is 20.

The files with sticky bits (2555 and 4555) has no permissions, but other files has permissions set properly.

So?
#AIX-Forum

Originally posted by: flodstrom

The most obvious thing may be that someone or something changed the permissions. If you have "stat" available, check the change time of the files before you do anything to the affected files.

Other than that I would probably start to get a bit paranoid about it, like an uninvited user? Perhaps it may be some form of file system corruption or the system drive having problems (about to start failing?)?

Can you still change the permission on any of those commands? Does the command(s) still work?
#AIX-Forum

Originally posted by: Tibor_B

In the meantime I changed the permissions according to another server. So far everything works fine, including those commands that were without permissions.

I can not see any motivation for such strange thing. What is also strange is that server was fully operational as if somebody just picked not critical commands.

An idea about failing drive... there are no errors in error log, no, I dont think it is the case.

So as the server works fine, the issue is closed for me now, but still if anybody has any idea I will like to hear it.
#AIX-Forum