Files Hidden From Root?

C

Celeryman

Limp Gawd
Joined
Jan 16, 2003
Messages
418
Yesterday, my web server (a Trustix 2.2 machine) was showing all the files in my www directory. Today, I only see a fraction of those files even when I am root. Apache still parses and displays files that according to "ls" should not be there. I can't upload any files to the directory either, but I was able to yesterday.

Does anybody have an idea of what is going on?
 
Could be a whole host of malicious problems: rootkit, root isnt root anymore, etc...

Are you sure that apache is serving them up and they arent cached locally(or in a proxy)?
 
Yes, there is no proxy or cached copies. Do you have a suggestion on what to use to check for a rootkit?
 
Yep, it ended up being a raid controller problem. It says the memory is either corrupted or the battery needs to be replaced. Hmmm, guess I will be calling Dell!
 
Another thing to keep in mind is that, on most Unix systems, if an application has opened a file, even if you delete or rename it, the file is still 'around' until the application releases the file.

An example I've seen on several occasions - let's say you're running Apache and have it writing a log to /sites/foo.com/live/log/error.log . You're doing an upgrade to /sites/foo.com/staging - and it looks good. Next thing you do is "mv live bak; mv staging live".

Guess what? Until you restart apache, it's still logging to the original log file.
 
I figured the pages still showing up had to be stored in memory somehow, because they couldn't have been coming from the disk. I was seeing ext3-fs errors scrolling on the screen when I went to the server room. I couldn't do anything besides view some files from putty. We will see what the Dell tech can do tomorrow. Should I hold my breath? lol
 
You must log in or register to reply here.
Back
Top