LinuxSA Mailing list archives

  From: Phil Pittard <vk5ham@seol.net.au>
  To  : linuxsa@linuxsa.org.au
  Date: Tue, 30 Nov 1999 08:00:08 +1030

Strange File in /tmp

Hi... I have written & installed some perl scripts on a number of boxes
which I "babysit" - among other things these scripts monitor & record
ANY/ALL changes in directories & files including size, length,
permissions, dates, new_files etc etc & email me if there are any
changes.... 1 box (a proxy server running squid) recently recorded the
creation of a file in /tmp with an "interesting" name. The newly created
file is: /tmp/iNsT-a.10521 & is  zero bytes in length. The use of
lowercase UPPERCASE, ie/ iNsT,  bothers me a bit!! 

I have NOT iNsTalled anything on this box (I am the only person with
root access) for quite some time so its not a "legitimate" install log,
however none of my other scripts reports any newly created directories
or files or any other "untoward" activity. I know that the /var/log/
files have not been modified as they are copied hourly to another pc and
compared to the previous hours logs & I am emailed if they differ etc
etc. I thought that the 10521 perhaps referred to a process but no such
process was/is running with that PID. I can find no evidence of an LRK
and the machine is performing as per normal.

I have checked /tmp on a total of 15 pc's running various distro's of
Linux (this one is RH) and not one has any files with "iNsT". I have
seriously monitored activity/processes etc on this box for a week since
the file was created and all appears OK, nevertheless it stills bothers
me.

So, has anyone seen an "iNsT" file before or have any clues as to what
it is/what created it???
I would appreciate it if ppl who have access to /tmp on a squid proxy
server could check if they have any similar files.

I have also done a search on Altavista on "iNsT" and received ZERO
matches!

TIA, Phil.
----------

-- 
LinuxSA WWW: http://www.linuxsa.org.au/  IRC: #linuxsa on irc.linux.org.au
To unsubscribe from the LinuxSA list:
  mail linuxsa-request@linuxsa.org.au with "unsubscribe" as the subject