I have an inherited server (foo) which I am told is receiving backups via rsync from various hosts (bar1, bar2, etc).

I'm looking to identify network information (hostname or ip address) for bar from information available on foo. Such that I can log into bar and disable any rsync backups. I am told that all data from bar systems is being backed up into /u on foo. /u appears to be populated with home directories.

I do not know when these backups from bar systems are run, or how long they may be running.

  • 1
    Please add more details to your question. Is "foo" running a backup server, or is it a client of a different backup server? What do you mean by "find bar"? Do you want to know where it is physically? Do you want to know its IP address? Do you want to know where its backups live? The more details, the better, so please be verbose. – jayhendren Nov 16 '16 at 17:37
  • Doesn't this depend on what's being backed up via rsync? I mean if /etc/hostname is backed up, that would tell you something...... – Elder Geek Nov 16 '16 at 17:39

First thing I would do is identify at which time rsync is being run. You can do this with auditd

Put a watch on rsync executable on your server

which rsync
auditctl -w /usr/bin/rsync -k rsync

Then you can periodically check if auditd logged any access like this

ausearch -i -k rsync

Once you know times when rsync runs - you can now identify which remote hosts use it.


See process tree and identify what rsync uses

pstree -p|grep -i rsync

And check which remote hosts are connected to PID 26209

netstat -anp|grep 26209
tcp        0      0    *                   LISTEN      26209/sshd          
tcp        0      0              ESTABLISHED 26209/sshd          
tcp        0      0 ::1:6010                    :::*                        LISTEN      26209/sshd 

All this assumes that rsync actually takes some time, so you can execute those pstree and netstat commands. If rsync is very quick - there are other ways to do tracing, but it will be more heavy (systemtap is on my mind for this, but start from simple and if that doesn't work - we will discuss more complex solutions).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.