Audit By Shutting Stuff Down

Sometimes the only way to tell if someone is using something is to shut it off.

You can send notices, post web pages, and announce in meetings that you’re going to take a web server down, delete an email alias, or decommission a server. The hour after you’re done someone will come up to you and need it turned back on. Or, sometimes it takes a month.

Maybe I’m not saying the right words in my announcements. Maybe I should pore over tcpdump output to determine who is using something. Maybe I should trust my users less to know what they are doing.

What I do know is that a trial outage will always be part of my plan from now on, leaving myself enough time to turn the box, service, or whatever it is back on again for that one last thing.