topic Re: How to remove in Operating System - HP-UX

How to remove

Surajit Santra — Mon, 04 Jan 2010 05:27:51 GMT

Hi,

I have found that one file has been create in root which is not showing file permission, owner and file name. As well as this file is occupied a lot of space in root. For this reasons I want to remove this file and free the root space.
But I cann't remove this file. Please give the necessary steps for resolve this issue.

Thanks & regards

Surajit

Re: How to remove

Steven Schweda — Mon, 04 Jan 2010 05:37:17 GMT

> [...] which is not showing file permission,
> owner and file name.

What, exactly, does this mean? Showing
actual commands with their actual output can
be more helpful than vague descriptions and
interpretations.

> But I cann't remove this file. [...]

"I can't do something" is not a useful
problem description. It does not show what
you did. It does not show what happened when
you did it.

Re: How to remove

R.K. # — Mon, 04 Jan 2010 05:41:03 GMT

Hi Surajit,

How are you trying to remove it?

rm does not work?

Re: How to remove

johnsonpk — Mon, 04 Jan 2010 05:56:32 GMT

Hi Surajit,

can you post ls -li output

if the inode number for that file is known ,we can remove it with find command

rgds!
Johnson

Re: How to remove

Khalid Shakoor — Mon, 04 Jan 2010 05:58:51 GMT

Hi Surahit,

Please send the ls -ltr output and mention which file you want to remove.

Normally rm will work for you if you want to forcefully remove use rm -rf .

Be careful it will not prompt you for confirmation ,for more details check man rm

Khalid

Re: How to remove

Michael Steele_2 — Mon, 04 Jan 2010 06:33:32 GMT

ls -il {file-name}

find . -inum [inode-number] -exec rm -i {} \;

Re: How to remove

johnsonpk — Mon, 04 Jan 2010 06:36:32 GMT

Hi Surajit,

Here is the steps if you know inode number for the file

1) list inum for file

#ls -li
2) confirm it with find comand
# find . -inum -exec ls -l {} \;

3) if the above command listing your proposed file , delete it with the below command

#find . -inum -exec rm {} \;

rgds!
Johnson

Re: How to remove

Surajit Santra — Mon, 04 Jan 2010 07:07:19 GMT

Hi,

I am sending the output -

# ls -li
total 3899994
rw------- 1 root sys 1969295360 Dec 29 15:30

2273 -rw------- 1 root sys 52534 Nov 5 10:22 .ICEauthority
3197 -rw------- 1 root sys 221 Nov 5 10:22 .TTauthority
3218 -rw------- 1 root sys 343 Nov 5 10:22 .Xauthority
2244 drwxr-xr-x 11 root sys 8192 Nov 5 10:26 .dt
2269 -rwxr-xr-x 1 root sys 5451 Oct 10 2007 .dtprofile
2242 -r--r--r-- 1 bin bin 1063 Jul 30 14:54 .profile
3115 -rw-rw-rw- 1 root sys 39 Jul 8 2008 .rhosts
3252 -rw------- 1 root sys 23068 Jan 4 12:32 .sh_history
2270 drwxr-xr-x 2 root sys 96 Oct 3 2008 .ssh
2268 drwxr-xr-x 5 root sys 96 Oct 11 2007 .sw
3022 drwxrwxrwx 2 root sys 96 Jul 28 19:16 DATA-PROTECTOR
3153 lrwxrwxrwx 1 root sys 10 Oct 3 2008 HORCM -> /opt/HORCM
2434 lr-xr-xr-t 1 root sys 8 Oct 11 2007 bin -> /usr/bin
3099 drwxrwxrwx 2 root sys 96 Jul 8 2008 cdrom
3091 -rw------- 1 root sys 848448 Mar 8 2008 core.2008-03-26-20:31:50
95 -rw------- 1 root sys 848448 Oct 20 2008 core.2008-10-27-15:31:13
3164 -rw------- 1 root sys 848448 Dec 2 2008 core.2008-12-06-17:57:52
2 drwxr-xr-x 4 oracle dba 96 Jul 29 19:45 crs
8212 drwxr-xr-x 5 oracle dba 184 Oct 24 22:52 dbbackup
72 dr-xr-xr-x 20 bin bin 8192 Jan 2 22:40 dev
2487 drwxrwxrwx 2 root sys 96 Dec 12 2007 dvd
4 dr-xr-xr-x 32 bin bin 8192 Dec 15 19:43 etc
2 dr-xr-xr-x 6 bin bin 96 Mar 17 2009 home
2532 dr-xr-xr-x 4 root sys 96 Dec 12 2007 hpap
2075 lr-xr-xr-t 1 root sys 8 Oct 11 2007 lib -> /usr/lib
3037 drwx------ 3 root sys 8192 Oct 23 2008 logs
3 drwxr-xr-x 2 root root 96 Sep 8 2004 lost+found
2882 -rw-rw-rw- 1 root sys 0 Dec 13 2007 mapfile
5 dr-xr-xr-x 1 root root 1 Dec 15 19:42 net
2792 -rw-rw-rw- 1 root root 15196 Mar 24 2008 null
2 dr-xr-xr-x 86 bin bin 8192 Oct 21 2008 opt
2 drwxr-xr-x 3 oracle dba 96 Mar 31 2009 oraarch
2 drwxr-xr-x 5 oracle dba 1024 Dec 19 2008 oracle
3209 -r--r--r-- 1 root sys 964 Jul 30 14:42 profile_bkp
15 dr-xr-xr-x 15 bin bin 8192 Dec 12 2007 sbin
3157 -rw------- 1 root sys 4426 Jul 30 14:57 sh_history_bkp
2529 -r-xr-xr-x 1 root sys 23666073 Dec 12 2007 sp2p2
3084 -rw-r--r-- 1 root sys 1023860 Jul 9 2008 sqlnet.log
2 dr-xr-xr-x 9 bin bin 8192 Dec 15 19:41 stand
2 drwxrwxrwt 26 root root 8192 Jan 4 12:28 tmp
13 drwxr-xr-x 3 root root 96 Feb 8 2008 u01
14 drwxr-xr-x 2 root root 96 Mar 20 2009 u02
2 dr-xr-xr-x 23 bin bin 8192 Oct 11 2007 usr
2 dr-xr-xr-x 25 bin bin 8192 Oct 10 2007 var
# find . -inum -exec ls -l {} \;
sh: inode: Cannot find or open the file.
#

Please check this -
total 3899994
rw------- 1 root sys 1969295360 Dec 29 15:30

Re: How to remove

Steven Schweda — Mon, 04 Jan 2010 07:35:40 GMT

> # find . -inum -exec ls -l {} \;
> sh: inode: Cannot find or open the file.

Arrgh. He meant to substitute the actual
inode number for "".

I'd explain it all in more detail, but then
my head might explode.

Re: How to remove

R.K. # — Mon, 04 Jan 2010 07:55:14 GMT

Yes, you need to use inode number to delete this file.

inode number is mentioned in the first column (extreme left) of "ls -il" output.

Go into that directory where that file is present, then

# find . -inum [inode-number] -exec rm -i {} \;

Use "rm -i" option so that it will ask for confirmation before deleting the file, so you will be sure that you are deleting correct file.

Re: How to remove

johnsonpk — Mon, 04 Jan 2010 08:19:12 GMT

Steven & R.K >> have you guys noticed this

total 3899994
rw------- 1 root sys 1969295360 Dec 29 15:30

it doesn't have inode number .. looks strange !!

any idea??

Re: How to remove

Surajit Santra — Mon, 04 Jan 2010 09:39:31 GMT

Hi,

I amd send the output of ls -il and
find . -inum [inode-number] -exec rm -i {} \; cmd output -

# ls -il
total 3899994
rw------- 1 root sys 1969295360 Dec 29 15:30

2273 -rw------- 1 root sys 52534 Nov 5 10:22 .ICEauthority
3197 -rw------- 1 root sys 221 Nov 5 10:22 .TTauthority
3218 -rw------- 1 root sys 343 Nov 5 10:22 .Xauthority
2244 drwxr-xr-x 11 root sys 8192 Nov 5 10:26 .dt
2269 -rwxr-xr-x 1 root sys 5451 Oct 10 2007 .dtprofile
2242 -r--r--r-- 1 bin bin 1063 Jul 30 14:54 .profile

# find . -inum [inode-number] -exec rm -i {} \;
find: bad -inum value [inode-number]
#

Please notice this -
rw------- 1 root sys 1969295360 Dec 29 15:30 there is no inode number. So how can i use rm -i cmd ?

Please give suggestion.

Re: How to remove

Matti_Kurkela — Mon, 04 Jan 2010 10:19:28 GMT

Maybe the filename includes terminal control characters that cause the inode number to be erased from display as soon as the filename is displayed. This suggests it might be a malicious attempt to hide the file and/or intentionally make it difficult to remove. Or it might be the result of major fat-fingering with the cursor keys.

Please try again, with "ls -ilb".
Adding the -b option replaces all terminal control and other special characters with harmless \NNN equivalents.

Alternatively, use "ls -ilq" which replaces special characters with question marks.

It's usually possible to copy&paste the filename from the output of either of the above-mentioned commands, for example to rename the file to something that's easier to use. (Type "mv -i ", then copy & paste the filename, then type " suspicious_file" and press Enter.)

If you can, first rename the file to something simple (like "suspicious_file"), and use the "fuser -u suspicious_file" to identify any process(es) accessing that file.
If there is even a single process accessing the file, the disk space won't be released until that process closes the file, or the process dies.

Find out what these processes are and stop them if possible. (If the file is being accessed by e.g. an Oracle database engine, you might want to talk with the DBA before stopping any processes or deleting the file.)

You might want to examine the file too: use "file suspicious_file" to try and identify the file type, or "strings suspicious_file | more" to take a peek inside it to see if there is something recognizable.

MK

Re: How to remove

Dennis Handly — Mon, 04 Jan 2010 18:42:16 GMT

>I have found that one file has been create in root which is not showing file permission, owner and file name.

It has valid permissions and owner, it's just the filename has control chars in it.

>MK: It's usually possible to copy&paste the filename from the output of either of the above-mentioned commands,

Right, with the -q case, make sure you use "rm -i".

Re: How to remove

Albert Smith_1 — Tue, 05 Jan 2010 03:09:32 GMT

If all else fails login to a CDE/Gnome session and use the file manager/Nautilus to move to that area and select and delete the file. But you would need to do this as root.

Re: How to remove

john korterman — Tue, 05 Jan 2010 12:28:58 GMT

Hi,

try listing the file like this:

# ls -l | cat -v

regards,
John K.

Re: How to remove

Viktor Balogh — Tue, 05 Jan 2010 15:12:47 GMT

before you remove anything, be sure that no process is using that file.

# fuser FILENAME

Otherwise the space won't be freed up until the process terminates.