On 10/08/19 7:53 AM, Greg Marks wrote: > On a computer running Debian 10, in a number of directories a > subdirectory "history" has mysteriously appeared containing a > file history.db. There are 11 of these history.db files in various > places in my home directory; cmp reveals that they are all identical. > Each is an "SQLite 3.x database, last written using SQLite version > 3027002." Each is a 12288-byte file containing, in addition to a > bunch of special characters, the words: "tableversionversionCREATE > TABLE version ( version VARCHAR NOT NULL, datfile VARCHAR UNIQUE NOT > NULL)-Andexsqlite_autoindex_version_1version." In some (but not all) > cases the timestamp on history/history.db matches the timestamp of some > file I was editing with vim 8.1.1401 in the same directory containing the > history subdirectory--for whatever that's worth--but I can't reproduce > the phenomenon by editing similar files with vim. All history/history.db > files appeared since upgrading from Debian 9. I couldn't find anything > relevant in the log files around the timestamps of the mystery files.
Are they open by some process? Check with lsof. Any clues from what directories they appear in? Are they in home directories? /etc tree? /var tree? If you're familiar with sqlite (or even sql, and can google the specifics), you could dig around inside and see if you can get any clues that way. Richard
signature.asc
Description: OpenPGP digital signature
