Unknown File

[Amiel Tutolo]

I have a file that is showing up in /home/oracle8 and the filename is (null). I have checked with our DBA and he says it is not coming from Oracle. (Of course...It never comes from Oracle). Below are a few lines from the file.

[Tue Oct 30 03:20:35 2001 EST]::Client Connected [ConnId=0, Sockfd=19, PID=13200
]
[Tue Oct 30 03:21:31 2001 EST]::Client Status [ConnId=0, PID=13200]
>> Read EOF on socket, Connection terminated
[Tue Oct 30 03:21:31 2001 EST]::Client Disconnected [ConnId=0, Sockfd=0, PID=132
00]
[Tue Oct 30 07:10:21 2001 EST]::Client Connected [ConnId=1, Sockfd=19, PID=13244
]
[Tue Oct 30 07:10:38 2001 EST]::Client Status [ConnId=1, PID=13244]
>> Read EOF on socket, Connection terminated

Can anyone help me with this? Has anyone ever see this? I have looked and looked and can not figure out where it is coming from. Thanks in advance for your help.

[Jeff Machols · Accepted solution]

see if you can do an fuser on the file, that will show any processes with the file open

[Patrick Wallek]

You could also try using lsof to see who or what has the file open.

[Amiel Tutolo]

Please tell me what lsof is? Thanks

[A. Clay Stephenson]

Hi:

lsof is list open file. It is a non-standard utility that is available from any of the HP-UX Porting Centre's. It is a tool no admin should be without.

I would try one more thing. Do an ls -b. This will print any non-printable ASCII characters in the filename as octal digits. It is possible that the filename only appears to be null.

[Roger Baptiste]

Hi,

INfo on lsof and the download link:

lsof-4.55
List files, sockets, etc opened by processes. Also gives a large amount of other related information. Can select by process ID, username or filename. It is a complete redesign of the fstat/ofiles utilities. This release now has lots of additions and bug fixes including support for HP-UX 11.X. Note that the binary releases of lsof on this archive will ONLY run on OS release they were compiled on and will run on 32-bit HP-UX only. If you have any other release of HP-UX, you must build lsof yourself from the source code.

http://hpux.cs.utah.edu/hppd/hpux/Sysadmin/lsof-4.55/

-raj

[Roger Baptiste]

hi,

I would also suggest to track the processes writing into the file by running,
ps -ef in a loop and redirecting it to a file and greping the process id shown in the unknown file to the psef output file.

while true
do
ps -ef >>/tmp/psout
sleep 10
done &

grep /tmp/psout

The process name would give clue on what is actually writing/owning the file in question.

HTH
raj

[Wodisch]

Hello Amiel,

this looks like an Oracle listener logfile (so it IS oracle, actually) using the protocl "IPC" (which is named pipes). Could it be someone has added a parameter into Oracle's listener.ora or sqlnet.ora, and assigned the value of "(null)" to the name of the logfile (do not remember the parameter name)? Read those files in "/etc/" or "$ORACLE_HOME/network/admin/" to check.
HTH,
Wodisch