topic Re: Random files made size zero in Operating System - HP-UX

Random files made size zero

Cara Tock — Fri, 27 Feb 2004 10:44:53 GMT

I have just found out that I have files randomly spread out on my HP-UX 11.0 box that are now of size zero. These are real files that we have been using that are now suddenly at size zero. Does anyone have any idea how this could happen other than someone gaining access and doing it deliberately?
Thanks
Damon

Re: Random files made size zero

Sridhar Bhaskarla — Fri, 27 Feb 2004 10:48:44 GMT

Hi Damon,

Note the time stamps of these files. Run 'last -R' and find out the logins that match these time stamps and that have permissions to alter these files. Ofcourse, one could use 'touch' to alter the time stamps.

If you don't find any, then check your all cronjobs for jobs that run during that time. You may want to view those cronjobs and see anything suspecious.

-Sri

Re: Random files made size zero

Robert-Jan Goossens — Fri, 27 Feb 2004 10:50:26 GMT

Damon,

Could you give us a few examples of those files ( PATH and file names ) ?

Kind regards,
Robert-Jan

Re: Random files made size zero

G. Vrijhoeven — Fri, 27 Feb 2004 10:56:44 GMT

Hi Damon,

Like the others have mentioned check cron and server access. Did those file change onwnership or mode? (users umask) Check passwd file for strange things failed sulogs stange ip-adresses that have connected?

Gideon

Re: Random files made size zero

Cara Tock — Fri, 27 Feb 2004 11:02:01 GMT

All of the time stamps are the same which indicates to me that a process did this. I looked at crontab and I don't see anything. The files are spread out and I noticed it when I tried to restart named. I typed in /usr/sbin/sig_named restart and nothing happened. I found out that the file this is linked to was of size zero. The file is /usr/contrib/bind/usr/sbin/sig_named. I found almost all of the files in /opt/dce/bin to be of size zero. I also had 2 files out of hundreds in a directory that holds all of the executables for our application to be of size zero.

Re: Random files made size zero

Cara Tock — Fri, 27 Feb 2004 11:06:12 GMT

The files didn't have the ownership changed or the mode. They looked exactly like they should except for two things, timestamp and size.

Re: Random files made size zero

Steven E. Protter — Fri, 27 Feb 2004 11:45:36 GMT

The filesystem is full.

When HP-UX filesystems, especially root on 11.00 get 100% full, files randomly get reset to zero bytes. On root, thats usually /etc/passwd or /etc/group

Clear space and it will stop happening.

If the machine is exposed to hackers, this is a known deffect and they may be trying to do this intentionally.

#!/bin/sh
#
# disk.hogs Created 10/16/2002
# Steven E. Protter
#
# Find disk piggies..........................
#
# #!/bin/ksh

# disk_hogs.ksh

# This script will list the top 10 disk hog users in the /home/oradev
# directory, and also will list the 15 largest files in there.
du -kx / | sort -rn | more

SEP