Am 25.03.20 um 05:18 schrieb Russell Coker: > I created a user on the 21st of March, logged in a couple of times, then > didn't use that account again. Now on the 25th of March I have a mapped > deleted file. The command "journalctl --rotate" fixes the problem. > > root@sevm:~# last|grep test > test pts/1 103.75.204.226 Sat Mar 21 13:36 - 13:37 (00:00) > test pts/1 103.75.204.226 Sat Mar 21 13:36 - 13:36 (00:00) > root@sevm:~# id test > uid=1002(test) gid=1002(test) groups=1002(test) > root@sevm:~# ps aux|grep journald > root 293 0.0 0.0 67932 16016 ? Ss Mar24 0:29 /lib/ > systemd/systemd-journald > root@sevm:~# grep dele /proc/293/maps > 7fca8e8ef000-7fca8f0ef000 rw-s 00000000 00:15 2013277 /var/ > log/journal/68f1b89bf8c73b0ed9ed905f535fa641/ > user-1002@6cf63a35b84c49e8b4fc99b777fb7629-0000000000000000-0000000000000000.journal > > (deleted) >
Can you find out, how the file was deleted?
signature.asc
Description: OpenPGP digital signature
