Package: unattended-upgrades Version: 0.93.1+nmu1 Unattended-upgrades was caught red-handed writing a rotated and deleted log file:
# ps -ef --forest : root 6413 1 0 16:35 ? 00:00:00 /bin/sh /usr/lib/apt/apt.systemd.daily install root 6417 6413 0 16:35 ? 00:00:00 \_ /bin/sh /usr/lib/apt/apt.systemd.daily lock_is_held install root 6452 6417 34 16:35 ? 00:03:25 \_ /usr/bin/python3 /usr/bin/unattended-upgrade root 6551 6452 0 16:39 ? 00:00:01 \_ /usr/bin/python3 /usr/bin/unattended-upgrade root 11212 6551 0 16:44 pts/1 00:00:00 \_ /usr/bin/dpkg --status-fd 10 --configure --pending root 13809 11212 0 16:45 pts/1 00:00:00 \_ /bin/sh /var/lib/dpkg/info/shared-mime-info.postinst triggered /usr/share/mime/packages root 13810 13809 2 16:45 pts/1 00:00:00 \_ update-mime-database.real /usr/share/mime : # lsof -p 6551 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME unattende 6551 root cwd DIR 253,3 4096 305351 /var/backups unattende 6551 root rtd DIR 253,3 4096 2 / unattende 6551 root txt REG 253,3 4747120 526262 /usr/bin/python3.5 unattende 6551 root mem REG 253,3 42070743 262177 /var/cache/apt/pkgcache.bin unattende 6551 root mem REG 253,3 51280 524318 /usr/lib/x86_64-linux-gnu/libapt-inst.so.2.0.0 unattende 6551 root mem REG 253,3 51160 532850 /usr/lib/python3/dist-packages/apt_inst.cpython-35m-x86_64-linux-gnu.so unattende 6551 root mem REG 253,3 37616 543419 /usr/lib/python3.5/lib-dynload/_lzma.cpython-35m-x86_64-linux-gnu.so unattende 6551 root mem REG 253,3 22000 543348 /usr/lib/python3.5/lib-dynload/_bz2.cpython-35m-x86_64-linux-gnu.so unattende 6551 root mem REG 253,3 114376 543183 /usr/lib/python3.5/lib-dynload/_ssl.cpython-35m-x86_64-linux-gnu.so unattende 6551 root mem REG 253,3 72024 528697 /usr/lib/x86_64-linux-gnu/liblz4.so.1.7.1 unattende 6551 root mem REG 253,3 154376 656328 /lib/x86_64-linux-gnu/liblzma.so.5.2.2 unattende 6551 root mem REG 253,3 66992 655796 /lib/x86_64-linux-gnu/libbz2.so.1.0.4 unattende 6551 root mem REG 253,3 84848 656656 /lib/x86_64-linux-gnu/libresolv-2.24.so unattende 6551 root mem REG 253,3 92584 662982 /lib/x86_64-linux-gnu/libgcc_s.so.1 unattende 6551 root mem REG 253,3 1566168 525136 /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.22 unattende 6551 root mem REG 253,3 1776872 524776 /usr/lib/x86_64-linux-gnu/libapt-pkg.so.5.0.1 unattende 6551 root mem REG 253,3 333408 532920 /usr/lib/python3/dist-packages/apt_pkg.cpython-35m-x86_64-linux-gnu.so unattende 6551 root DEL REG 253,3 525453 /usr/lib/x86_64-linux-gnu/libcrypto.so.1.1 unattende 6551 root DEL REG 253,3 525457 /usr/lib/x86_64-linux-gnu/libssl.so.1.1 unattende 6551 root mem REG 253,3 25360 543181 /usr/lib/python3.5/lib-dynload/_hashlib.cpython-35m-x86_64-linux-gnu.so unattende 6551 root mem REG 253,3 47632 656648 /lib/x86_64-linux-gnu/libnss_files-2.24.so unattende 6551 root mem REG 253,3 47688 656651 /lib/x86_64-linux-gnu/libnss_nis-2.24.so unattende 6551 root mem REG 253,3 89064 656640 /lib/x86_64-linux-gnu/libnsl-2.24.so unattende 6551 root mem REG 253,3 31616 656644 /lib/x86_64-linux-gnu/libnss_compat-2.24.so unattende 6551 root mem REG 253,3 1689360 656626 /lib/x86_64-linux-gnu/libc-2.24.so unattende 6551 root mem REG 253,3 1063328 656634 /lib/x86_64-linux-gnu/libm-2.24.so unattende 6551 root mem REG 253,3 105088 656059 /lib/x86_64-linux-gnu/libz.so.1.2.8 unattende 6551 root mem REG 253,3 170128 657482 /lib/x86_64-linux-gnu/libexpat.so.1.6.2 unattende 6551 root mem REG 253,3 10688 656660 /lib/x86_64-linux-gnu/libutil-2.24.so unattende 6551 root mem REG 253,3 14640 656632 /lib/x86_64-linux-gnu/libdl-2.24.so unattende 6551 root mem REG 253,3 135440 656655 /lib/x86_64-linux-gnu/libpthread-2.24.so unattende 6551 root mem REG 253,3 153288 656615 /lib/x86_64-linux-gnu/ld-2.24.so unattende 6551 root 0u CHR 1,3 0t0 1028 /dev/null unattende 6551 root 1u REG 253,3 25109 395436 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.1 (deleted) unattende 6551 root 2u REG 253,3 25109 395436 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.1 (deleted) unattende 6551 root 3u CHR 1,3 0t0 1028 /dev/null unattende 6551 root 4u REG 253,3 25109 395436 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.1 (deleted) unattende 6551 root 5w REG 253,3 71817 395416 /var/log/apt/term.log.1 (deleted) unattende 6551 root 6w REG 253,3 16039 395418 /var/log/apt/history.log.1 (deleted) unattende 6551 root 7u CHR 5,2 0t0 20 /dev/ptmx unattende 6551 root 8u CHR 136,1 0t0 4 /dev/pts/1 unattende 6551 root 9r FIFO 0,10 0t0 77207 pipe unattende 6551 root 48r FIFO 0,10 0t0 36365 pipe unattende 6551 root 49w FIFO 0,10 0t0 36365 pipe # ls -al /var/log/unattended-upgrades/unattended-upgrades-dpkg.log* -rw-r----- 1 root adm 0 Jul 25 16:39 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log -rw-r----- 1 root adm 342 Jul 25 16:39 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.1.gz -rw-r----- 1 root adm 904 Mar 20 09:10 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.2.gz -rw-r----- 1 root adm 2077 Jan 15 2018 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.3.gz -rw-r----- 1 root adm 379 Sep 14 2017 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.4.gz -rw-r----- 1 root adm 1808 Sep 13 2017 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.5.gz -rw-r----- 1 root adm 5451 Aug 1 2017 /var/log/unattended-upgrades/unattended-upgrades-dpkg.log.6.gz Regards Harri
