Admin horror stories

[Tom Buskey]

On 10/11/07, Bruce Dawson <jbd at codemeta.com> wrote:
>
> Tom Buskey wrote:
> > I had a user call about a user supported system that was having
> issues.  We
> > explicitly do not support it and the users only use the root account.
> >
> > He gave me the root account to login and I couldn't.  I went to his
> system &
> > looked around.  /etc was empty.  I told him he was fsked and he should
> ftp
> > any files he wanted to elsewhere & that he wouldn't be able to login
> again
> > or reboot.  In any event, we were not supporting it.
> >
> > Sure enough, a help desk ticket came in for another admin, claiming that
> the
> > system got corrupted during bootup.  Why do users lie so often?  All it
> does
> > is obscure the problem...
> >



Hmmm. Did you check lost+found? I've had similar symptoms only to
> discover that there was indeed a bad sector that remapped all of /etc/
> and some of /var and /usr. fsck didn't help much until I moved the drive
> to another system and ran fsck there.


If /etc was empty, login would not have been able to find root's password in
/etc/passwd.  He had to have been in /etc and done rm * or similar after
logging in.
There was nothing in /var/adm/messages (it was Solaris).

I really didn't care how/what happened.  But if you spilled a bottle of milk
on the floor, don't tell me a cow came through and had its udder burst.
Just tell me you spilled some milk.


> But you're right - if its not supported, then they'll have to go
> elsewhere to get this done.
>
> BTW: My point is: the user may not have lied, but was just calling the
> shot as s/he saw them.


Maybe I shouldn't have used the word lie, but the system could only be like
that IMO if the user wiped /etc after logging in and I told him the he
wouldn't be able to login again and /etc was wiped.  Whoever took the ticket
was looking for a corrupted disk instead of a wiped /etc.

I think it's alot like "The system is slow.  What did you guys do?  I didn't
touch anything" and then you find out they installed WeatherBug or some
such.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.gnhlug.org/mailman/private/gnhlug-discuss/attachments/20071011/c5de64ea/attachment.html