/ partition full

[gben]

I got this weired problem. In the past if / is full I'd just zap the logs and it should OK. But last night when I got the / partition full error, I found /var/adm/wtmpx was huge. So I did this hoping to ease the situation:

cat /dev/null > /var/adm/wtmpx

/ became about 88% but soon climbed up to 100% full again.

Also, I found a directory in /home but I couldn't access it. A short while later, it was gone.

# pwd
/home
# ls -l
total 1
dr-xr-xr-x 1 root root 1 Nov 2 10:46 www
# pwd
/home
# cd www
^Cwww: bad directory
#

Is this system being compromised?

Your inputs will be appreciated.

 

[KenCunningham]

It's possible, but you should perhaps have had a look (with last) at the wtmp before zapping it, as this might have given a clue as to what was happening. Don't know anything about the

http://www directory,

but it seems odd - perhaps others can help?

 

[crowe]

"the ^Cwww: bad directory" responce looks like there could have been control characters in the previous "cd

http://www"

command. does the /home/

http://www dir

still exist on the system?

crowe

 

[gben]

The directory is gone.

I see these in /etc/just now:

prw------- 1 root root 0 Nov 28 09:47 initpipe|
prw------- 1 root root 0 Nov 28 09:47 utmppipe|

Looks like the time stamp is updated everytime someone logged in? I just logged in.