Mysterious "zeroing" of files...

[SteveB42]

I have had two users in the last few months come to me about files that mysteriously becoming "empty". The first type were some raw data files (ascii). The second were .Z compressed files... but not all of them in the directory. Seems random. Has anyone heard of this? It isn't a disk space issue and the files were set to read only. Looked at his sh_history and saw nothing suspicious either. Anyone, anyone? Bueller, Bueller?

 

[gheist]

check your disks (ie "smitty errpt&quot
check if you are safe from hostile internet (-:

 

[Yegolev]

I suspect user error. Have they set noclobber? Do they understand how to redirect without clobbering? I'm glad I don't do much user support.

 

[SteveB42]

Gheist,

Disks are fine... errpt shows nothing untoward...

Yegolev,

I am starting to suspect a restore from tape I did a few months ago... and just what is noclobber? And can you explain how redirect could zero out the contents of a file?

Thanks,

Steve

 

[gheist]

What is common to zeroing - i think a root is only user that can do such harm

Which way files are zeroed - they are of zero lenght? (skulker or something like that is set up to push users back in their quota) or they are filled by nothing (0x00/0xdeadbeef/0xff) ? (shutdown to single mode ("cd / && shutdown -m now&quot and fsck them again

 

[aixqueen]

Just some random thoughts...
I know that if you are on a modem in the smit menus and you get disconnected,
or there is static on the line , or you cntrl d or ctrl c or exit not correctly from the menus, it will sometimes zero out the files.(as in size of file is zero bytes)...It happens mostly with the printer menus.... but it does happen.

What do these users have in common? How do they enter the system, Telnet, modem, remote lines? Perhaps their cables are loose, or they are in a hurry and exit incorrectly ? from a particular program? (you could trap their exits so they cant exit by using ctrl keys...Or maybe they just turn off their terminal? I assume it is their files? or they are in the group of the files that get zerod out?

Oh well...Just some random thoughts.

 

[Yegolev]

Per the clobbering question, I have been known to direct output using > into a file I had been reading from. That doesn't work, file goes bye-bye. You should redirect into a different file. Setting "noclobber" should help avoid that but sometimes I can mangle files anyway. Perhaps only root can do it, mostly I try to not do stupid things but that does not always work. =)

 

[Yegolev]

Oh yeah...

set -o noclobber

 

[SteveB42]

Thank you guys for your help!! It turned out to be a home grown script one of my super-users wrote!