After a bit of investigation, I have found that a statically linked version of 'ls' is able to see the files, which suggests a problem with a library somewhere. The odd thing is, this is just a plain vanilla install of woody, updated from security.debian.org. I have run chkrootkit on the machine, and all the libraries look like the right size. I still don't know what the cause is yet, but at least I have found something that might help track it down
Campbell [EMAIL PROTECTED] [EMAIL PROTECTED] wrote: > Hi, > > We have an unusual problem with 'invisible' and disappearing files: some files are > not > visible in a directory using 'find' or 'ls' on the directory, yet they > are visible using tools such as 'debugfs' or if you know the actual name > of the file, you can use 'ls' to list it explicitly. > > For instance, in the directory: > > /home/stampy/queues/sendsyphonemailqstore/q_dispatch > > you can ls -la it, and find no files: > > > stampy:~# ls -la /home/stampy/queues/sendsyphonemailqstore/q_dispatch > total 8 > drwxr-sr-x 2 louisb staff 4096 Jun 25 11:45 . > drwxr-sr-x 7 louisb staff 4096 Jan 4 14:05 .. > > Yet when you 'ls' the files directly (which we find from the log of a > daemon that places them there), they are there: > > stampy:~# ls -la > /home/stampy/queues/sendsyphonemailqstore/q_dispatch/1088004896841 > -rw-r--r-- 1 louisb staff 1 Jun 24 01:34 > /home/stampy/queues/sendsyphonemailqstore/q_dispatch/1088004896841 > stampy:~# > > This is occuring on two machines running Debian Woody, 2.4.25 and 2.4.18 > kernels. The filesystems have had fsck run on them, and the systems are > not able to clean the /tmp directory because of these 'missing' files > > Other info: > > ext2 filesystems > libc-2.2.5.so > gcc version 2.95.4 20011002 (Debian prerelease) > > On both machines, the problems are showing up in the /tmp/CGI_Cache > directory. The filesystems have not run out of inodes > > Any ideas what could cause this? It has happened on a 3rd machine now > too. One of the machines uses hardware scsi RAID and the other two are > using IDE (different chipsets, one VIA, the other AMD) > > > Thanks for any pointers, > > Campbell > > > -- > To UNSUBSCRIBE, email to [EMAIL PROTECTED] > with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED] > -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
