UNIX for Advanced & Expert Users

Gurus

I am running an AIX 7.1 system and have come across a strange [ and hopefully explainable ] issue.

I am trying to delete files from a folder using standard 'rm' syntax. After i delete the files , files re-appear again.

File renaming or editing does not help. Files re-appear with 0 bytes again. They are always 0 bytes.

I have checked processes running under this user as well all in general but it's hard to say which process/daemon is causing this happen.

Any light shed on this in highly appreciated !

Abhi

What does ls -l show for one of these files? They are regular files, correct?

This sounds very strange.

Are the inode numbers the same before and after?

Code:

# ls -li

will give you the inode number of each file in column 1.

We would all assume that the files are being emptied (zero length) so the inode numbers would remain the same. If however the inode numbers change then something is recreating the files.

---------- Post updated at 10:38 AM ---------- Previous update was at 10:28 AM ----------

Another thought is to search your system for all files called 'rm'.

Are you running the 'rm' that you think you are?

Perhaps someone has created a script named 'rm' which is being found first on the search path and you are not executing the actual operating system command that you thought you were.

Inode numbers stay the same. Everything is just what it was. File names, sizes , inode numbers ,file timestamps.

One more observation

If i copy files to this folder from 'somewhere' using ftp/sftp ,this strange behavior takes place but if i create a file in this folder ,say, using 'touch' and delete it , it does not re-appear.

I have checked all possible scripts and none of them use 'rm' in them.

Abhi

---------- Post updated at 09:08 PM ---------- Previous update was at 07:50 PM ----------

these are regular files...


anyone has any direction for me ?


Abhi

---------- Post updated at 09:18 PM ---------- Previous update was at 09:08 PM ----------

i am seeing something like

Code:

<Server_Name>:<ID_HOME/Test $ ps -aef | grep 8847604
    root  8847604 15466562   0 11:36:45      -  0:00 sshd: ID@notty
ID  9109518  8847604   0 11:36:49      -  0:00 /usr/sbin/sftp-server -m /etc/ssh/sshd_config

This looks like a loop to me .... can i break it with 'pkill' or something ?


Abhi

These just look like child and parent processes to me. I don't see a problem there.

I think we need to review the facts of this issue.

The files you have trouble deleting are ONLY the one's created via ftp/sftp from another system, yes?

The files created in that way can then be listed and show a non-zero size, and are normal files, yes?

When you 'rm' these files they "re-appear" as zero length files. Do they actually get removed and then recreate themselves, or do they simply get reduced to zero length? Can you tell what is happening?

You say the inode numbers aren't changing. If you create, say, 10 files via ftp and list them, all 10 will be zero length after rm with the same inode numbers, yes?

What type of filesystem is it? I'm not an AIX expert but have you checked the integrity of this filesystem with the appropriate tool?

If you have more than one filesystem does this issue occur if you try it on another filesystem?

Sorry for all the questions but this issue sounds real strange.

Incidentally, files being created via ftp with zero length is a well known problem on some Unix O/S's but you definitely say that the created files are non-zero when first copied onto the system?

Did you check if the file is in use before you deleted them - maybe by the sftp-process? It's been a while since I worked with AIX last, but fuser -f </path/to/file> should give you this information (or you can install lsof).