Re: Any Advice On Strange Error?

From: Mike Brown (mike@tkg.ca)
Date: 04/09/03 

From: Mike Brown <mike@tkg.ca>
Date: Wed, 09 Apr 2003 12:55:14 GMT

Elliot J wrote:
>
> Hi Group,
>
> Our software support helpdesk is currently looking into a strange problem
> we're encountering on SCO UNIX v5.0.4 Enterprise OpenServer, running
> PROGRESS v8.2C.
>
> As of yesterday, when users ran our custom PROGRESS database query routines,
> they would randomly fail to run and rename themselves from (for example)
>
> pdb.t
> pdb.p
> pdb.y
>
> to:
>
> `db.t
> `db.p
> `db.y
>
> As far as I know (I was away ill yesterday), no errors were being reported
> by Varnet, the PROGRESS software which invokes our custom programs. Varnet
> is a sales/accounts application suite based on PROGRESS.
>
> This morning, PROGRESS 'appeared' to have died completely, not letting
> anyone into our database at all. But not giving an error, just dropping us
> back to the dollar prompt when we attempt to start up the database.
>
> If I 'ls' our main work directory, '/usr/castle' then it lists a lot of
> files with beginning characters replaced by ` (apostraphe?). Others to note
> are:
>
> 'rocore
> 'rotrace.26956
>
> The helpdesk has found that if we log into UNIX as different users - we
> generally all log in under one user name (namely 'castle'), then we can
> start up the PROGRESS database, seemingly okay.
>
> But I am still unhappy that it's simply a 'corrupt' user profilem, which is
> what the helpdesk is labelling it as at the moment.
>
> Has anyone seen this renaming of files before?
>
> Any comments or suggestions, highly appreciated!
>
> Regards,
>
> --
>
> Elliot Johnson
> IT Administrator
> www.johnsmallmanltd.co.uk
>
> "toby.Harman" <toby.Harman.ll9cm@progresstalk.com> wrote in message
> news:toby.Harman.ll9cm@progresstalk.com...
> >
> > Interesting that it appears to be "p" that is replaced with apostrophe!
> >
> > Terminal emulation? Has anything changed? You could try the brute force
> > method and create a file with everything modified in the last 2 days
> > and see if there are any suspicious entries.
> >
> > "find / -mtime -2 -print" should get it.
> >
> > Happy hunting
>
> Hi Toby,
>
> Thanks for the response,
>
> I output the results to a file and have posted here
> http://www.johnsmallmanltd.co.uk/filelist.htm.
> If you, or anyone else, would be so kind, any chance you could have a quick
> glance? I'm not too familiar with UNIX, so am not sure if anything looks
> suspicious or not.
>
> I changed the date in your suggestion to go back 5 days instead of 2, as I
> have a feeling this may go back to last Friday.
>
> The mystery has become more bizarre today, as, overnight, some files have
> had 's' in their title replaced with a 'p'!
>
> Strangely, these files have not been date stamped to reflect the time of
> this name change. For example, one file renamed last night, is still date
> stamped as Jan 31 2002.
>
> I am cross-posting this message to a UNIX group or two, as I do not feel
> it's just relating to PROGRESS.
>
> Any more help or suggestions, highly appreciated!

A move command does not change the creation time, so it is your likely
suspect. Do you have any scripts running that may have access to that
directory? Search them for a "mv", something like "grep mv *.sh".

A users environment may be missing a directory path, and now performing
a mv in the progress program area.

Mike 

-- 
Michael Brown
The Kingsway Group