Datafile ownership changes to root root from oracle dba

[roadwarriorDBA]

This is the 2nd time this has happened at one clients shop that I am aware of in just 3 weeks.

I chown'ed them back but did not realize that oracle had given up on them and they needed 'recover datafile'. That mistake prolonged the outage. Oddly oracle stopped complaining about the datafile in the alert log.

These are 'raw' chunk files and I believe but am not sure that veritas is involved.

How might the ownership be changing? Who is doing it ?
How can I found out who did it ?

thx

[marist89]

How can I found out who did it ?

Change the root password so only you and one other person knows it. When it happens again, you will know who didn't do it and you can go on from there. Oracle shouldn't care who the owner is as long as he has permission to write.

[davey23uk]

if the ownerships are changed to root root then oracle wont have write, i believe they are rw-r--r-- (i think)

any cron jobs doing a chown? - is it just the datafiles or the whole system?

[marist89]

if the ownerships are changed to root root then oracle wont have write, i believe they are rw-r--r-- (i think)

depends on what root's umask is...

[roadwarriorDBA]

if the ownerships are changed to root root then oracle wont have write, i believe they are rw-r--r-- (i think)

any cron jobs doing a chown? - is it just the datafiles or the whole system?

2 datafiles out of the group, not aware of any others. Not sure how many it was last time. Does veritas netbackup have a tendency to do this ?

[marist89]

2 datafiles out of the group, not aware of any others. Not sure how many it was last time. Does veritas netbackup have a tendency to do this ?

It's been 5 years since I worked with NB, but I don't think so.

[roadwarriorDBA]

It's been 5 years since I worked with NB, but I don't think so.

Its was only one datafile before, this time 2. Different times as well. That sounds more like sabotage now.

Prolly need sudosh to record everything that is happening under root.

[dbtoo]

Its was only one datafile before, this time 2. Different times as well. That sounds more like sabotage now.

Prolly need sudosh to record everything that is happening under root.

Are the admins doing a restore? This can happen when the admins restore files from the netbackup. It may even be a side affect that they didn't realize, while restoring other files for 'other' people.

[roadwarriorDBA]

We are the admins. They outsource to us. Sombody at the client has root though.

[dbtoo]

We are the admins. They outsource to us. Sombody at the client has root though.

Isn't there a log under /var/adm that tracks the logins, and from what terminal? If it's pts, then definately, change the password.