LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Desktop (https://www.linuxquestions.org/questions/linux-desktop-74/)
-   -   problem with .xsession-error file (https://www.linuxquestions.org/questions/linux-desktop-74/problem-with-xsession-error-file-4175437981/)

Jc61990 11-20-2012 11:10 AM

problem with .xsession-error file
 
Here is the Current System Configuration for my Question.

OS: CentOS 6.3 x86_64
DE: Gnome2
Purpose: Dedicated Server.
CPU: 2x Dual-Core Xeon 3.60GHz
RAM: 12gb
HDD: 5x 500GB WD RE4 drives

system = 500GB (independent hdd)
/home = 500GB (independent hdd)
/NAS = 1.5TB (3x 500GB Raid 0)
---------------------------------------

Recently i have just discovered a weird issue on my server.

I only noticed this yesterday when i tried to upload a 15kb text file to my website. When i received the message (Failed to upload: Out of disk space) i thought to my self thats impossible, after doing some troubleshooting, i found that my /home partition had 0 bytes free.

My /home partition is dedicated to one of those 500GB hard drives.

as root i "cd /home" then "du -sh *" with the output:
Code:

[root@server ~]# cd /home
[root@server home]# du -sh *
483G    jc61990
32K    usr1
634M    usr2
16K    lost+found
1.6G    usr3
1.8G    usr4
604M    usr5
18M    usr6
5.2G    usr7
[root@server home]#

my own personal user account seems to be the issue taking up almost all the space on my drive. So after going into my directory and then listing all files i saw
Code:

-rw------- 1 jc61990 jc61990 499970249795 Nov 19 11:02 .xsession-errors
so now that i found the problem file, i wanted to see the cause: reading the last few lines of the file didnt really help, and i cant open the file in gedit, vi, or nano because of how large it is, so i used tail.
Code:

[root@server jc61990]# tail -n 20 .xsession-errors
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message
20/11/2012 12:08:05 PM Authentication deferred - ignoring client message

so this is where you guys come in, what does this error mean?

i deleted the 483GB error file yesterday, and this morning it was back up to 183GB, this file is increasing fast and its just the same error over and over.

would anyone here have any clue as to what is going on / a way to resolve this?

thanks

unSpawn 11-20-2012 11:45 AM

Quote:

Originally Posted by Jc61990 (Post 4833402)
what does this error mean?

It seems the culprit is VNC or an equivalent. This implies the server runs an X server (which should not be necessary) and running unprotected VNC (that's an accident waiting to happen): use VNC over SSH if you must use VNC.

Jc61990 11-22-2012 11:32 AM

looks like it was my vnc, i usually only use vnc through vpn. I believe the vnc server is tigervnc does anyone know where connection logs are kept? i want to check if someone was trying to bruteforce my vnc


All times are GMT -5. The time now is 05:28 PM.