Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm very very tired, worked all night long, and I did't sleep for hours... So I'm like a zombie now... half awake, and half asleep.

I was trying to clear a directory. Then I run the command cd to enter the directory, and then before thinking I run this dangerous command. on my Linux server:

 "find  / -mtime +1 -exec rm {} \;"

I got a lot of:

rm: cannot remove `/sys/module/serio_raw/sections': Is a directory
rm: cannot remove `/sys/module/pcspkr': Is a directory
rm: cannot remove `/sys/module/pcspkr/sections': Is a directory
rm: cannot remove `/sys/module/dm_raid45': Is a directory
rm: cannot remove `/sys/module/dm_raid45/sections': Is a directory
rm: cannot remove `/sys/module/dm_message': Is a directory
rm: cannot remove `/sys/module/dm_message/sections': Is a directory

Could this command have deleted something inside these directories? I'm afraid that the next reboot the server won't startup...


share|improve this question

migrated from Jul 6 '11 at 12:49

This question came from our site for professional and enthusiast programmers.

Yes, you're royally screwed unless you have backups. You do have backups, don't you? If so, use them, if not consider this a valuable life lesson and (once you extricated yourself from this unholy mess) start doing them both regularly and frequently. – paxdiablo Jul 6 '11 at 10:41
What is your FS? Would you study a File System Forensics? I already did this for FFS2 FS after a rm-rf (several TB of data). – osgx Jul 6 '11 at 10:47
fortunatelly, it looks like nothing was removed. I stopped the commando, before it leaving the /sys directory, that was the first one. – valter Jul 6 '11 at 10:57
up vote 2 down vote accepted

/sys, like /proc is a virtual directory. You cannot really delete anything in there - certainly nothing that a reboot won't restore.

The same can't be said about your on-disk filesystems though. rm without -r won't delete a directory, but along with find it can easily delete all files under it. The -mtime +1 sort of restricts the extent of the damage, but does not prevent it.

You might want to use your package management system to at least verify the system files before rebooting. Also, check with find / in what order are the directories listed. Perhaps you got lucky and /sys was the first - you did interrupt the command right away, right?

share|improve this answer
It looks like nothing was deleted: When I run find / as you said, I got: root@server [/sys]# find / / /sys /sys/module /sys/module/ipt_owner /sys/module/ipt_owner/sections – valter Jul 6 '11 at 10:47
is there any log where is stored a list with everything that could have been deleted? – valter Jul 6 '11 at 11:04
@Valter: no, there is no log. However, the order find presents the contents of a directory is the native order of the filesystem and does not change unless you add/remove something. Running find / would show you the order in which the directories were accessed. – thkala Jul 6 '11 at 11:20
That said, you should use your package management system to verify the system files and you should probably compare with your backups for missing files. If you have setup locate you might also use locate / and a bit of shell trickery to find missing files since the last time the locate DB was updated. – thkala Jul 6 '11 at 11:22

Yes: rm fails deleting directories, but find "digs" inside them, if it can, and calls rm on files contained

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .