no /var/spool anymore

[lsbotech]

Hi guys,

Someone removed the entire /var/spool on one of my servers.
I recreated the /var/spool/cron as I could, but in your opinion, what is the best way to deal with that?
Can I just recreate every folders by looking at another server?
Is there something to be especially careful with?
I am afraid that they are collateral damages at the next reboot.

Regards,
L.

[Miven]

Someone removed the entire /var/spool on one of my servers.

Dude, on my system /var/spool is owned by root and only root can write to it, and if someone removed the dir, then I have 3 guesses:

1. Some numbskull has root password and you should change it. Do this anyway.

2. Your hard drive is going rotten and you should fsck it.

3. You have some rootkit installed, and you should *very*carefully* inspect all running processes and the system in general for infestation. Check /tmp. I once found some vermin hiding in there that managed to compile itself and was gnawing on my eth0 connection. I think it got in through a hole in gnapster, which I was running at the time.

Good luck.

[lsbotech]

1. Some numbskull has root password and you should change it. Do this anyway.

Good luck.

Yeah, that's it.

You are absolutely right, but I still need to repair...
Thanks.
L.

[Miven]

/var/spool:

drwxr-xr-x root root spool

Everything in there is system dependent. Look in /var/log/ for errors when they crop up, and fix them.