Problems after filesystem housekeeping

UNIX HP-UX
1

I have noticed that after I clear up the /var filesystem, there are always problems.

Does deleting the OLDsyslog.log file cause problems like missing directories and problems accessing crontabs?

There were two situations where I faced problems.
1) Deleted OLDsyslog.log (Of course I created an archive of this before deleting).
The next day there were problems of missing directories in a path not even related to the log which is /var/adm/syslog.

2) In this situation, I also did the same - deleted old syslog, and backdated ones, and now there is another problem, whereby users are not able to access their crontab :

$ crontab -l
crontab: you are not authorized to use cron.  Sorry.
bscs.L28bi02> (/bscsbin/lisa)

And so I checked the server, and found that even the cron directory went missing! So this means that everything under cron like cron.allow was gone. I had to manually create the directory and this file for the user to be able to use it again.

Now the user can list the crontab entries, but not able to save new cron entries :

/var/tmp/aaaa15475" 277 lines, 14951 characters cron may not be running - call your system administrator

I restarted cron, then I can save the entries.

Also, I realize now that many directories in /var/adm are missing. Like /var/adm/sa, /var/adm/syslog.
I cannot even get any output from the command "last". (To check who deleted the files). The error is :

# last
 : No such file or directory
2
  1. What shell are you using?
  2. Exactly what command did you use to remove OLDsyslog.log ?
  3. Exactly what command did you use to remove the old syslog and the backdated log files?
3

1)What shell are you using?

# cat /etc/shells
/sbin/false
/usr/bin/sh
/sbin/sh
/opt/mastersam/bin/msh
/opt/ssh/utils/sftponly
# echo $SHELL
/sbin/sh
#

2)Exactly what command did you use to remove OLDsyslog.log?

I first archive it to a different location, then in /var/adm/syslog :

# rm OLDsyslog.log

3)Exactly what command did you use to remove the old syslog and the backdated log files?

I first put all these files in one directory. After archiving this directory onto another place, I deleted it with the command :

# rm -rf <dirname>
4

And what directory name argument did you use when you issued the command:

# rm -rf <dirname>

while running as root?

5

Hi,

I created a directory named logarch in /var/adm/syslog :

# mkdir logarch

I then moved all the OLDsyslog files and other backdated log file into this directory :

# mv OLDsyslog logarch
# mv mail.logSAMTRM logarch

After archiving this directory to a different location, I then delete it in /var/adm/syslog :

# rm -rf logarch

And of course I do this in while I am in /var/adm/syslog.

---------- Post updated at 06:17 PM ---------- Previous update was at 04:03 PM ----------

And yes, I did the steps above as root user.

6

I knew that you were removing the files while running as root. But the symptoms you are describing are those of removing something other than a directory containing old files. It sounds a lot more like you are removing all of the files starting a layer or two higher in the directory hierarchy than the file hierarchy rooted in /var/adm/syslog/logarch .