Gentoo Archives: gentoo-server

From: "Jonathan S. Romero" <jonnyro@××××××××××××××××.com>
To: gentoo-server@l.g.o
Subject: Re: [gentoo-server] interesting occurence
Date: Tue, 28 Sep 2004 15:22:24
Message-Id: 41598173.6080608@jonnyro.isa-geek.com
In Reply to: Re: [gentoo-server] interesting occurence by Drake Wyrm
1 Drake Wyrm wrote:
2
3 >At 2004-09-27T14:29:45-0400, "Jonathan S. Romero"
4 ><jonnyro@××××××××××××××××.com> wrote:
5 >
6 >
7 >
8 >>Ben Munat wrote:
9 >>
10 >>
11 >>>Jonathan S. Romero wrote:
12 >>>
13 >>>
14 >>>>Ben Munat wrote:
15 >>>>
16 >>>>
17 >>>>>Jonathan S. Romero wrote:
18 >>>>>
19 >>>>>
20 >>>>>>Ben Munat wrote:
21 >>>>>>
22 >>>>>>
23 >>>>>>
24 >>>>>>>Here's a weird occurence that has me stumped. Logged into my
25 >>>>>>>gentoo server and did an "ls" in root's home directory. Mixed in
26 >>>>>>>with all the files I expected in there were a number of empty
27 >>>>>>>text files... and here's the strange part: the names of the files
28 >>>>>>>were random snippets from an email that I received a while back!
29 >>>>>>>
30 >>>>>>>
31 ><snip>
32 >
33 >
34 >>>>>>Did the files have maildir style names?
35 >>>>>>
36 >>>>>>
37 >>>>>>
38 >>>>>Not sure what you mean "maildir style names"... the names of the
39 >>>>>files were random bits of (I believe) a single email. So, the file
40 >>>>>listing looked something like this:
41 >>>>>
42 >>>>>root@foo>ls
43 >>>>>somerealfile.txt
44 >>>>>myrealpackage.tgz
45 >>>>>been meaning to call and talk to him but I
46 >>>>>anotherrealfile.jpg
47 >>>>>the other day. So, Bob was saying that I could probably get a
48 >>>>>anotherfile
49 >>>>>etc.
50 >>>>>
51 >>>>>This isn't an actual listing... I deleted the files already. They
52 >>>>>were empty files and their names were seemingly random bits of
53 >>>>>text. However, I recognized pieces of that text to have come from
54 >>>>>an email that my Aunt sent me a while back.
55 >>>>>
56 >>>>>
57 ><snip>
58 >
59 >
60 >>Can you check your syslogs to check for reboots?
61 >>
62 >>If you get a reboot without the corresponding service shutdown
63 >>messages, then you might have had some hard shutdowns.
64 >>
65 >>
66 >
67 >Interesting thought... How could an unexpected shutdown lead to the
68 >given indications?
69 >
70 >
71 >
72 The absence of such indications. If you are missing the service
73 shutdown messages, and you see a line that says "syslog starting", then
74 you know you had a hard crash.
75
76 -Jonathan S. Romero