On Wed 07/Feb/2018 00:34:59 +0100 Sam Varshavchik wrote: >> >> Curiously, I found this file name: >> .5058547.1517362926.M462851P21244V0000000000006811I0000000000566211_0.north,S=4981 >> >> >> Regular mail files don't have that leading ".5058547". What does it mean, is >> it for temporary files? >> >> The timestamp 1517362926 is Jan 31, but the file's st_mtim was 1517563957, >> exactly the core dump epoch. Could that hint what might have happened? > > Where was it? The main directory, tmp, or new or cur? Neither maildrop nor > Courier-IMAP renames a message file, once it exists in new or cur. > > The code that creates new message file doesn't use this kind of a prefix; > checked both maildrop, deliverquota, and courier's built in maildir delivery > code itself, it all uses the same code. Pretty sure nothing in Courier would > create a filename like that. The "_0" part of the filename gets used by > Courier, so without that extra prefix this would definitely be a > Courier-created file.
Hmm... I looked at other elements in the same node, and all of them have the same '.5058547.' prefix: (gdb) p (*(*(*(TCP_Client*)0x1a9f4c0).to_be_scanned.root).key[0]).myname $3 = 0x18479b0 ".5058547.1517362926.M462851P21244V", '0' <repeats 12 times>, "6811I0000000000566211_0.north,S=4981" (gdb) p (*(*(*(TCP_Client*)0x1a9f4c0).to_be_scanned.root).key[1]).myname $4 = 0x19cfd10 "" (gdb) p (*(*(*(TCP_Client*)0x1a9f4c0).to_be_scanned.root).key[2]).myname $5 = 0x19d1ad0 "" (gdb) p (*(*(*(TCP_Client*)0x1a9f4c0).to_be_scanned.root).key[3]).myname $6 = 0x1dbe700 ".5058547.1517362927.M690717P21565V", '0' <repeats 12 times>, "6811I000000000056622B_0.north,S=4977" (gdb) p (*(*(*(TCP_Client*)0x1a9f4c0).to_be_scanned.root).key[4]).myname $7 = 0x2145240 ".5058547.1517360350.M457750P18964V", '0' <repeats 12 times>, "6811I0000000000564F88_0.north,S=7685" (gdb) p (*(*(*(TCP_Client*)0x1a9f4c0).to_be_scanned.root).key[5]).myname $8 = 0x21a3020 ".5058547.1517276523.M857008P29878V", '0' <repeats 12 times>, "6811I0000000000564F17_0.north,S=5345" (gdb) p (*(*(*(TCP_Client*)0x1a9f4c0).to_be_scanned.root).key[5]) The string "myname" appears a surprisingly low number of times in the 10,000+ lines of code, and nowhere it looks like adding or removing prefixes. Thanks Ale
signature.asc
Description: OpenPGP digital signature
