From owner-freebsd-questions Mon Oct 12 13:47:47 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id NAA08094 for freebsd-questions-outgoing; Mon, 12 Oct 1998 13:47:47 -0700 (PDT) (envelope-from owner-freebsd-questions@FreeBSD.ORG) Received: from resnet.uoregon.edu (resnet.uoregon.edu [128.223.144.32]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA07983 for ; Mon, 12 Oct 1998 13:47:22 -0700 (PDT) (envelope-from dwhite@resnet.uoregon.edu) Received: from localhost (dwhite@localhost) by resnet.uoregon.edu (8.8.8/8.8.8) with ESMTP id NAA21980; Mon, 12 Oct 1998 13:47:02 -0700 (PDT) (envelope-from dwhite@resnet.uoregon.edu) Date: Mon, 12 Oct 1998 13:47:01 -0700 (PDT) From: Doug White To: Roman Katsnelson cc: "q's" Subject: Re: v: huge random file, why? In-Reply-To: <3621FDAE.AAA2BAA1@graphnet.com> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Mon, 12 Oct 1998, Roman Katsnelson wrote: > I run a web server on 2.2.7 with Apache 1.3.2, and everything runs > beautifully. Over the weekend, though, the root fs ran out of space: it > went from 25M (25%) on Friday night to 103M (104%) on Monday morning. > Searching for what could've caused this, I found this file: > > -rw-r--r-- 1 root wheel 78749696 Oct 10 19:47 v ^^^^^ Anyone on at this time? Try 'file v' and see what it is. If it's a compress archive assume you've been comprimised. > The contents of the file looked like compiled code, but it wasn't > executable. What was particularly disturbing was that it was owned by > root.... Has anyone run into this at all? Any idea why it could happen? > And also, just as a side note, how can a file system take up more than > 100% of what it's alotted? See newfs(8) for why. It's a UFS performance tune. Doug White Internet: dwhite@resnet.uoregon.edu | FreeBSD: The Power to Serve http://gladstone.uoregon.edu/~dwhite | www.freebsd.org To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message