egrep: can't open output.txt error

[Madhava Rao Lakkaniki]

Hi all,

'egrep: can'open output.txt' error is generated(everyday 20000 entries) by unknown unix job process and appending to the unknown file in root partion. Due to this, root partion is growning 7% per week.

Initially, the above errors appending to rc.log file /etc directory. I written a perl script to remove the appended error lines in the rc.log and executed using crontab every day.
Then instead of adding the error lines to /etc/rc.log, it used to write into /etc/rc.log.old file. I ran the same perl script to remove the error lines for both files and scheduled.

After few days, it is stopped writing to the rc.log and rc.log.old files and writing(appending) to another file in the root partion.

How to identify which file it is appending and how to remove this error permanently. I am worried that it is going to fill entire root partion in a few weeks.

We are using HP UX 11.11 O/S on RP5470 computer.

Thanks for help,

Rao

[Sandman!]

Search for files under the "/" root partition for files that contain the strings "egrep" and "output.txt".

# find / -xdev -type f -exec egrep -il "egrep|output.txt" {} +

After obtaining the unknown filename...use lsof to figure out the process that is writing to the (now known) file i.e.

# lsof ""

[James R. Ferguson]

Hi Rao:

The culprit script would seem to be in your startup directories. Do:

# grep -e egrep -e output.txt /sbin/init.d/*

...to find the likely one.

Regards!

...JRF...

[A. Clay Stephenson · Accepted solution]

If I can make the assumption that this was a process started by rc (that is by no means certain since any process with proper permissions could write to rc.log), I would examine the files in /sbin/init.d. Something like cd /sbin/init.d; grep -i "output" * might be a good start. If this is an rc'ed process, it would have to be started in the background because the process hasn't terminated. I suspect that the actual file is not in /sbin/init.d but is rather a daemon started by rc. If you hadn't blown away rc.log entries there is a good chance that you could have rapidly narrowed the field as these error messages would have started to appear shortly after one of the rc'ed scripts was started. If you can reboot after cleaning rc.log, that would be a good method of narrowing the scope of your search.

It's always bad to treat the symptoms rather than the problem itself which your Perl script has done. You threw away the early data which would potentially have been very helpful.

[Tim Nelson]

I would assume that there is some poorly written startup program that holds these files open.

use lsof to try and isolate who has the files open

lsof /the_file_in_question

[Madhava Rao Lakkaniki]

Thanks for your help. I am sorry for late reply.
I have rebooted the UNIX production box and got the space back. It is cleared the space after the reboot.

Rao

[Madhava Rao Lakkaniki]

Got the space back in root partition after the reboot the server.