Home / server / Questions / 408273
In Process
Marco Ceppi
Asked: 2012-07-17 12:15:39 +0800 CST

Weird 0 byte files in root

  • 772

In the root of several of our old CentOS machines (CentOS release 5.8 (Final)) In the root of the ext3 file system I see the following:

wtf.

I've removed some of these, but they seem to continue coming back.

Here are the timestamps

-rw-rw----   1 root   root       0 2011-12-15 01:20 .?????????????????????????????????????????????????Z]Y?+
-rw-rw----   1 root   root       0 2011-12-16 01:14 .???????????????????????????????????????????????????ֽ*
-rw-rw----   1 root   root       0 2011-12-20 01:20 .?????????????????????????????????????????????????????*
-rw-rw----   1 root   root       0 2011-12-22 01:23 .??????????????????????????????????????????????????\X?*
-rw-rw----   1 root   root       0 2011-12-26 01:20 .????????????????????????????????????????????????????]+
-rw-rw----   1 root   root       0 2012-01-01 01:16 .?????????????????????????????????????????????????*???+
-rw-rw----   1 root   root       0 2012-01-04 01:15 .?????????????????????????????????????????????????????*
-rw-rw----   1 root   root       0 2012-01-11 01:14 .???????????????????????????????????????????????????;?+
-rw-rw----   1 root   root       0 2012-01-12 01:17 .?????????????????????????????????????????????????ZF.?*
-rw-rw----   1 root   root       0 2012-02-29 01:16 .?????????????????????????????????5?;J+
-rw-rw----   1 root   root       0 2012-02-29 01:17 .???????????????????????????????????e?*
-rw-rw----   1 root   root       0 2012-03-01 01:16 .??????????????????????????????????B)Q+
-rw-rw----   1 root   root       0 2012-03-06 01:08 .??????????????????????????????????'??+
-rw-rw----   1 root   root       0 2012-03-07 01:09 .?????????????????????????????????%?F?+
-rw-rw----   1 root   root       0 2012-03-22 01:07 .?????????????????????????????????%??+
-rw-rw----   1 root   root       0 2012-04-06 01:12 .?????????????????????????????????????*
-rw-rw----   1 root   root       0 2012-05-06 01:16 ??X?7+.?????????????????u{?7+
centos files

2 Answers

  1. Those seem to appear approximately the same time at near 01:10. Could there be a buggy cron job creating those files?

    • 3

  2. Hmmm. Are you running rsyslog / syslog-ng ... or any other logging daemon ? I bet that it's a rule running wild. If you are using rsyslog check working directory and your rules.

    Also you can try with lsof and if you are lucky the descriptor will be still alive and you will find the corresponding app.

    • 2