topic Re: Disappearing custom script file in API / CLI Discussion

Disappearing custom script file

Dariusz — Mon, 26 Jul 2021 08:42:57 GMT

Hi,

I have some problem with custom script running via cron on Management Server.

There is a file with custom script. Script run some mgmt_cli commands. All works perfectly but every two weeks after last modification of script file, the file with script is gone. Cron job was created as described sk77300.

How to find what is deleting script file? I was looking in messages file - nothing found, checked cron tasks list - nothing.

Is there some mechanism or hidden task on Check Point that could delete custom script files?

Re: Disappearing custom script file

PhoneBoy — Mon, 26 Jul 2021 21:30:33 GMT

Where precisely are you putting the script?

Re: Disappearing custom script file

Dariusz — Tue, 27 Jul 2021 05:35:03 GMT

Script is stored in subdirectory of home for user skrypty:

/home/skrypty/raporty_dobowe/skrypt_raporty.sh

and content of file skrypt_raporty.sh

#!/bin/bash -f

source /opt/CPshrd-R80.30/tmp/.CPprofile.sh

mgmt_cli -r true show-group name "Gr_Blocked_by_IOI" --format json | jq '.members[] | [.name, ."ipv4-address"] | @csv' -r > /home/skrypty/raporty_dobowe/raport_dobowy_$(date +"%d_%m_%Y").csv

mgmt_cli -r true show-group name "Gr_Blocked_by_IOI_FQDN" --format json | jq '.members[] | [.name] | @csv' -r > /home/skrypty/raporty_dobowe_FQDN/raport_dobowy_FQDN_$(date +"%d_%m_%Y").csv

sshpass -p XXXXX scp /home/skrypty/raporty_dobowe/raport_dobowy_$(date +"%d_%m_%Y").csv ioc@XXX.XXX.XXX.XXX:/opt/CPBlackIP

if it matters management server runs on R80.30 version.

Re: Disappearing custom script file

PhoneBoy — Tue, 27 Jul 2021 05:44:30 GMT

Nothing should be deleting anything out of the home directory automatically.
You can try using a chattr +i on the script file so it can't be deleted normally.
Recommend a TAC case to investigate this.

Re: Disappearing custom script file

Dariusz — Tue, 27 Jul 2021 06:07:25 GMT

OK, thank you for answer, will try with chattr :).