Random files made size zero

[Cara Tock]

I have just found out that I have files randomly spread out on my HP-UX 11.0 box that are now of size zero. These are real files that we have been using that are now suddenly at size zero. Does anyone have any idea how this could happen other than someone gaining access and doing it deliberately?
Thanks
Damon

[Sridhar Bhaskarla]

Hi Damon,

Note the time stamps of these files. Run 'last -R' and find out the logins that match these time stamps and that have permissions to alter these files. Ofcourse, one could use 'touch' to alter the time stamps.

If you don't find any, then check your all cronjobs for jobs that run during that time. You may want to view those cronjobs and see anything suspecious.

-Sri

[Robert-Jan Goossens]

Damon,

Could you give us a few examples of those files ( PATH and file names ) ?

Kind regards,
Robert-Jan

[G. Vrijhoeven]

Hi Damon,

Like the others have mentioned check cron and server access. Did those file change onwnership or mode? (users umask) Check passwd file for strange things failed sulogs stange ip-adresses that have connected?


Gideon

[Cara Tock]

All of the time stamps are the same which indicates to me that a process did this. I looked at crontab and I don't see anything. The files are spread out and I noticed it when I tried to restart named. I typed in /usr/sbin/sig_named restart and nothing happened. I found out that the file this is linked to was of size zero. The file is /usr/contrib/bind/usr/sbin/sig_named. I found almost all of the files in /opt/dce/bin to be of size zero. I also had 2 files out of hundreds in a directory that holds all of the executables for our application to be of size zero.

[Cara Tock]

The files didn't have the ownership changed or the mode. They looked exactly like they should except for two things, timestamp and size.

[Steven E. Protter]

The filesystem is full.

When HP-UX filesystems, especially root on 11.00 get 100% full, files randomly get reset to zero bytes. On root, thats usually /etc/passwd or /etc/group

Clear space and it will stop happening.

If the machine is exposed to hackers, this is a known deffect and they may be trying to do this intentionally.

#!/bin/sh
#
# disk.hogs Created 10/16/2002
# Steven E. Protter
#
# Find disk piggies..........................
#
# #!/bin/ksh

# disk_hogs.ksh

# This script will list the top 10 disk hog users in the /home/oradev
# directory, and also will list the 15 largest files in there.
du -kx / | sort -rn | more

SEP