Phantom file

[jpor]

Hi guys,

Currently doing some admin on our RS6000 server. And came across a rogue file in the /home directory.

I cannot rm the file. Even encapsulating it around speech marks.

Also when you run istat <filename> there doesn't appear to be an inode number against the file.

I take it this will disapear witha reboot ?

 

[sushveer]

Hi jpor

Did u check with ls -li <file-name>?
Can you give exact file and output of this commnad?

sushveer
IBM certified specialist-p-series AIX5L System Administration
AIX/SOLARIS/WEBSPHERE-MQ/TIVOLI Administrator

 

[jpor]

Sushveer.

This is the file when doing a ls -la:

-rwxr-xr-x 1 root system 1083 Sep 15 10:23 ccsrvkybH

This is the output from the ls -li ccsrvkybH

ls: 0653-341 The file ccsrvkybH does not exist.

 

[dickiebird]

What result do you get from ls ccsrvk* ?
Could it have non-printable characters on the end of the name ?



Dickie Bird (-)))

 

[jpor]

ls: 0653-341 The file ccsrvk* does not exist.

Is the answer to that one.

 

[bi]

do you get a return on this phantom file when you do an ls -li on the entire directory (rather then specifying the file in the ls -li command)?

 

[jpor]

Yes I do bi.

The thing is. When I run an istat against the file again no inode number is being associated with the file.

Looks like someone has tried to creat a user account and somehow it has screwed itsaelf up when being created.

 

[bi]

why do you think someone tried to create a user account?

And, I guess I should have been more specific: what is the return when you do ls -li on the entire directory (rather then specifying the file in the ls -li command)?

 

[jpor]

All our user account bar a few start as ccsrv.

The output from the ls_li on all files =

17 -rwxr-xr-x 1 root system 1083 Sep 15 10:23 ccsrvkybH

I do get all the others listed.

Looks like inode number '17'.

Thanks.

 

[bi]

you could try this:

cd into the directory.
type: find . -inum 17 -exec rm {}\;

 

[jpor]

bi. Thanks for that. Just tried to run it as per instructions and get the following:

find: 0652-018 An expression term lacks a required parameter.

 

[bi]

put a space between rm and the {. And there is no space between {} and no spaces here: }\;

 

[jpor]

bi. Copied and pasted the command a was posted by yourself.

I.e this is the exact command used:

find . -inum 17 -exec rm {}\;

 

[bi]

I'm sorry. here is how the spaces should be:

find [space] -inum [space]17 [space] -exec [space] rm [space] {} [space] \;

 

[jpor]

Fantastic. It's gone. Thanks bi.

You forgot to mentin the . in your command but I tried it with a -exec ls first to check.

Thanks again.

 

[unixtechie]

The reason was it had a character (not visable) in front of it, something like: [^filename

Whenever that happens, I use ksh and set an array:

set -A FILES $(ls /etc)

and delete the index:

rm ${FILES[2]}

Where the '2' is the 3rd file (ksh starts counting at 0).

 

[jpor]

Thanks UNIXTECHIE.

I'll bear that one in mind.

 

[RodKnowlton]

Rather than using ls first, if you know you're only after one file, you could use the -i flag to rm.

Saves a step and increases safety.


Rod Knowlton
IBM Certified Advanced Technical Expert pSeries and AIX 5L

 

[Tony48]

Another way to prove the filename contained a
non-printable character is to do a &quot;ls > /tmp/xx&quot;
to save the output of &quot;ls&quot; in /tmp/xx...

then use &quot;od -x /tmp/xx&quot; to dump the hex
of the output of &quot;ls&quot;.

FWIW, I always use the &quot;interactive&quot; mode of &quot;rm&quot;
(i.e. rm -i * ) to delete a file that contains
a non-printable character.

-tony

 

[jpor]

Nice handy hint there. Thanks Tony48.