On Saturday 27 September 2008 11:56:16 Colin Brace wrote:
> Mel-15 wrote:
> > The obvious a file in /, possibly a core dump.
> > The less obvious, an open but deleted file.
> > Even less obvious, a file in /tmp created in single user mode, without
> > /tmp
> > mounted.
> > My money is on option 2:
> > fstat -f / |sort -rnk 8|head
> OK, here is what that returns:
> $ sudo fstat -f / |sort -rnk 8|head
> root init 1 text / 16492 -r-xr-xr-x 599320 r
> root devd 618 text / 16467 -r-xr-xr-x 334060 r
> root dhclient 1192 text / 16469 -r-xr-xr-x 74172 r
> _dhcp dhclient 1231 text / 16469 -r-xr-xr-x 74172 r
> root fstat 78768 5 / 49687 -rw------- 40960 r
> root pflogd 478 text / 16527 -r-xr-xr-x 18716 r
> _pflogd pflogd 481 text / 16527 -r-xr-xr-x 18716 r
> root adjkerntz 136 text / 16457 -r-xr-xr-x 7244 r
> www php-cgi 69281 root / 2 drwxr-xr-x 512 r
> www php-cgi 1122 root / 2 drwxr-xr-x 512 r
> Do you see anything that looks unusual?
Nope, and of course not, since it persists over reboot. It must be a directory
you're not searching, maybe a dot directory.
Best run *in single user mode*, with only / mounted:
du -h -d1 .
> There is a tutorial here
>.php> which explains how to do this using dump and restore. Just curious:
> why is this preferable to using plain old cp?
- will copy foo/bar to dest/oops/bar if dest/foo is a symlink to dest/oops.
- does not copy hard links, but both 'files'
- cannot make consistent snapshots of a partition
Problem with today's modular software: they start with the modules
and never get to the software part.
email@example.com mailing list
To unsubscribe, send any mail to "[EMAIL PROTECTED]"