How to remove

[johnsonpk]

Steven & R.K >> have you guys noticed this

total 3899994
rw------- 1 root sys 1969295360 Dec 29 15:30

it doesn't have inode number .. looks strange !!


any idea??

[Surajit Santra]

Hi,

I amd send the output of ls -il and
find . -inum [inode-number] -exec rm -i {} \; cmd output -

# ls -il
total 3899994
rw------- 1 root sys 1969295360 Dec 29 15:30





2273 -rw------- 1 root sys 52534 Nov 5 10:22 .ICEauthority
3197 -rw------- 1 root sys 221 Nov 5 10:22 .TTauthority
3218 -rw------- 1 root sys 343 Nov 5 10:22 .Xauthority
2244 drwxr-xr-x 11 root sys 8192 Nov 5 10:26 .dt
2269 -rwxr-xr-x 1 root sys 5451 Oct 10 2007 .dtprofile
2242 -r--r--r-- 1 bin bin 1063 Jul 30 14:54 .profile


# find . -inum [inode-number] -exec rm -i {} \;
find: bad -inum value [inode-number]
#

Please notice this -
rw------- 1 root sys 1969295360 Dec 29 15:30 there is no inode number. So how can i use rm -i cmd ?

Please give suggestion.

[Matti_Kurkela]

Maybe the filename includes terminal control characters that cause the inode number to be erased from display as soon as the filename is displayed. This suggests it might be a malicious attempt to hide the file and/or intentionally make it difficult to remove. Or it might be the result of major fat-fingering with the cursor keys.

Please try again, with "ls -ilb".
Adding the -b option replaces all terminal control and other special characters with harmless \NNN equivalents.

Alternatively, use "ls -ilq" which replaces special characters with question marks.

It's usually possible to copy&paste the filename from the output of either of the above-mentioned commands, for example to rename the file to something that's easier to use. (Type "mv -i ", then copy & paste the filename, then type " suspicious_file" and press Enter.)

If you can, first rename the file to something simple (like "suspicious_file"), and use the "fuser -u suspicious_file" to identify any process(es) accessing that file.
If there is even a single process accessing the file, the disk space won't be released until that process closes the file, or the process dies.

Find out what these processes are and stop them if possible. (If the file is being accessed by e.g. an Oracle database engine, you might want to talk with the DBA before stopping any processes or deleting the file.)

You might want to examine the file too: use "file suspicious_file" to try and identify the file type, or "strings suspicious_file | more" to take a peek inside it to see if there is something recognizable.

MK

[Dennis Handly]

>I have found that one file has been create in root which is not showing file permission, owner and file name.

It has valid permissions and owner, it's just the filename has control chars in it.

>MK: It's usually possible to copy&paste the filename from the output of either of the above-mentioned commands,

Right, with the -q case, make sure you use "rm -i".

[Albert Smith_1]

If all else fails login to a CDE/Gnome session and use the file manager/Nautilus to move to that area and select and delete the file. But you would need to do this as root.

[john korterman]

Hi,

try listing the file like this:

# ls -l | cat -v

regards,
John K.

[Viktor Balogh]

before you remove anything, be sure that no process is using that file.

# fuser FILENAME

Otherwise the space won't be freed up until the process terminates.