How to remove

[Surajit Santra]

Hi,

I have found that one file has been create in root which is not showing file permission, owner and file name. As well as this file is occupied a lot of space in root. For this reasons I want to remove this file and free the root space.
But I cann't remove this file. Please give the necessary steps for resolve this issue.

Thanks & regards

Surajit

[Steven Schweda]

> [...] which is not showing file permission,
> owner and file name.

What, exactly, does this mean? Showing
actual commands with their actual output can
be more helpful than vague descriptions and
interpretations.

> But I cann't remove this file. [...]

"I can't do something" is not a useful
problem description. It does not show what
you did. It does not show what happened when
you did it.

[R.K. #]

Hi Surajit,

How are you trying to remove it?

rm does not work?

[johnsonpk]

Hi Surajit,

can you post ls -li output

if the inode number for that file is known ,we can remove it with find command

rgds!
Johnson

[Khalid Shakoor]

Hi Surahit,

Please send the ls -ltr output and mention which file you want to remove.

Normally rm will work for you if you want to forcefully remove use rm -rf .

Be careful it will not prompt you for confirmation ,for more details check man rm

Khalid

[Michael Steele_2]

ls -il {file-name}

find . -inum [inode-number] -exec rm -i {} \;

[johnsonpk]

Hi Surajit,

Here is the steps if you know inode number for the file

1) list inum for file

#ls -li
2) confirm it with find comand
# find . -inum -exec ls -l {} \;

3) if the above command listing your proposed file , delete it with the below command

#find . -inum -exec rm {} \;



rgds!
Johnson

[Surajit Santra]

Hi,

I am sending the output -

# ls -li
total 3899994
rw------- 1 root sys 1969295360 Dec 29 15:30





2273 -rw------- 1 root sys 52534 Nov 5 10:22 .ICEauthority
3197 -rw------- 1 root sys 221 Nov 5 10:22 .TTauthority
3218 -rw------- 1 root sys 343 Nov 5 10:22 .Xauthority
2244 drwxr-xr-x 11 root sys 8192 Nov 5 10:26 .dt
2269 -rwxr-xr-x 1 root sys 5451 Oct 10 2007 .dtprofile
2242 -r--r--r-- 1 bin bin 1063 Jul 30 14:54 .profile
3115 -rw-rw-rw- 1 root sys 39 Jul 8 2008 .rhosts
3252 -rw------- 1 root sys 23068 Jan 4 12:32 .sh_history
2270 drwxr-xr-x 2 root sys 96 Oct 3 2008 .ssh
2268 drwxr-xr-x 5 root sys 96 Oct 11 2007 .sw
3022 drwxrwxrwx 2 root sys 96 Jul 28 19:16 DATA-PROTECTOR
3153 lrwxrwxrwx 1 root sys 10 Oct 3 2008 HORCM -> /opt/HORCM
2434 lr-xr-xr-t 1 root sys 8 Oct 11 2007 bin -> /usr/bin
3099 drwxrwxrwx 2 root sys 96 Jul 8 2008 cdrom
3091 -rw------- 1 root sys 848448 Mar 8 2008 core.2008-03-26-20:31:50
95 -rw------- 1 root sys 848448 Oct 20 2008 core.2008-10-27-15:31:13
3164 -rw------- 1 root sys 848448 Dec 2 2008 core.2008-12-06-17:57:52
2 drwxr-xr-x 4 oracle dba 96 Jul 29 19:45 crs
8212 drwxr-xr-x 5 oracle dba 184 Oct 24 22:52 dbbackup
72 dr-xr-xr-x 20 bin bin 8192 Jan 2 22:40 dev
2487 drwxrwxrwx 2 root sys 96 Dec 12 2007 dvd
4 dr-xr-xr-x 32 bin bin 8192 Dec 15 19:43 etc
2 dr-xr-xr-x 6 bin bin 96 Mar 17 2009 home
2532 dr-xr-xr-x 4 root sys 96 Dec 12 2007 hpap
2075 lr-xr-xr-t 1 root sys 8 Oct 11 2007 lib -> /usr/lib
3037 drwx------ 3 root sys 8192 Oct 23 2008 logs
3 drwxr-xr-x 2 root root 96 Sep 8 2004 lost+found
2882 -rw-rw-rw- 1 root sys 0 Dec 13 2007 mapfile
5 dr-xr-xr-x 1 root root 1 Dec 15 19:42 net
2792 -rw-rw-rw- 1 root root 15196 Mar 24 2008 null
2 dr-xr-xr-x 86 bin bin 8192 Oct 21 2008 opt
2 drwxr-xr-x 3 oracle dba 96 Mar 31 2009 oraarch
2 drwxr-xr-x 5 oracle dba 1024 Dec 19 2008 oracle
3209 -r--r--r-- 1 root sys 964 Jul 30 14:42 profile_bkp
15 dr-xr-xr-x 15 bin bin 8192 Dec 12 2007 sbin
3157 -rw------- 1 root sys 4426 Jul 30 14:57 sh_history_bkp
2529 -r-xr-xr-x 1 root sys 23666073 Dec 12 2007 sp2p2
3084 -rw-r--r-- 1 root sys 1023860 Jul 9 2008 sqlnet.log
2 dr-xr-xr-x 9 bin bin 8192 Dec 15 19:41 stand
2 drwxrwxrwt 26 root root 8192 Jan 4 12:28 tmp
13 drwxr-xr-x 3 root root 96 Feb 8 2008 u01
14 drwxr-xr-x 2 root root 96 Mar 20 2009 u02
2 dr-xr-xr-x 23 bin bin 8192 Oct 11 2007 usr
2 dr-xr-xr-x 25 bin bin 8192 Oct 10 2007 var
# find . -inum -exec ls -l {} \;
sh: inode: Cannot find or open the file.
#


Please check this -
total 3899994
rw------- 1 root sys 1969295360 Dec 29 15:30

[Steven Schweda]

> # find . -inum -exec ls -l {} \;
> sh: inode: Cannot find or open the file.

Arrgh. He meant to substitute the actual
inode number for "".

I'd explain it all in more detail, but then
my head might explode.

[R.K. #]

Yes, you need to use inode number to delete this file.

inode number is mentioned in the first column (extreme left) of "ls -il" output.

Go into that directory where that file is present, then

# find . -inum [inode-number] -exec rm -i {} \;

Use "rm -i" option so that it will ask for confirmation before deleting the file, so you will be sure that you are deleting correct file.

[johnsonpk]

Steven & R.K >> have you guys noticed this

total 3899994
rw------- 1 root sys 1969295360 Dec 29 15:30

it doesn't have inode number .. looks strange !!


any idea??

[Surajit Santra]

Hi,

I amd send the output of ls -il and
find . -inum [inode-number] -exec rm -i {} \; cmd output -

# ls -il
total 3899994
rw------- 1 root sys 1969295360 Dec 29 15:30





2273 -rw------- 1 root sys 52534 Nov 5 10:22 .ICEauthority
3197 -rw------- 1 root sys 221 Nov 5 10:22 .TTauthority
3218 -rw------- 1 root sys 343 Nov 5 10:22 .Xauthority
2244 drwxr-xr-x 11 root sys 8192 Nov 5 10:26 .dt
2269 -rwxr-xr-x 1 root sys 5451 Oct 10 2007 .dtprofile
2242 -r--r--r-- 1 bin bin 1063 Jul 30 14:54 .profile


# find . -inum [inode-number] -exec rm -i {} \;
find: bad -inum value [inode-number]
#

Please notice this -
rw------- 1 root sys 1969295360 Dec 29 15:30 there is no inode number. So how can i use rm -i cmd ?

Please give suggestion.

[Matti_Kurkela]

Maybe the filename includes terminal control characters that cause the inode number to be erased from display as soon as the filename is displayed. This suggests it might be a malicious attempt to hide the file and/or intentionally make it difficult to remove. Or it might be the result of major fat-fingering with the cursor keys.

Please try again, with "ls -ilb".
Adding the -b option replaces all terminal control and other special characters with harmless \NNN equivalents.

Alternatively, use "ls -ilq" which replaces special characters with question marks.

It's usually possible to copy&paste the filename from the output of either of the above-mentioned commands, for example to rename the file to something that's easier to use. (Type "mv -i ", then copy & paste the filename, then type " suspicious_file" and press Enter.)

If you can, first rename the file to something simple (like "suspicious_file"), and use the "fuser -u suspicious_file" to identify any process(es) accessing that file.
If there is even a single process accessing the file, the disk space won't be released until that process closes the file, or the process dies.

Find out what these processes are and stop them if possible. (If the file is being accessed by e.g. an Oracle database engine, you might want to talk with the DBA before stopping any processes or deleting the file.)

You might want to examine the file too: use "file suspicious_file" to try and identify the file type, or "strings suspicious_file | more" to take a peek inside it to see if there is something recognizable.

MK

[Dennis Handly]

>I have found that one file has been create in root which is not showing file permission, owner and file name.

It has valid permissions and owner, it's just the filename has control chars in it.

>MK: It's usually possible to copy&paste the filename from the output of either of the above-mentioned commands,

Right, with the -q case, make sure you use "rm -i".

[Albert Smith_1]

If all else fails login to a CDE/Gnome session and use the file manager/Nautilus to move to that area and select and delete the file. But you would need to do this as root.

[john korterman]

Hi,

try listing the file like this:

# ls -l | cat -v

regards,
John K.

[Viktor Balogh]

before you remove anything, be sure that no process is using that file.

# fuser FILENAME

Otherwise the space won't be freed up until the process terminates.