[SOLVED] What's the 'history.db' file that keeps appearing in my home folder?

linustalman · 03-03-2021, 02:20 AM

Hi.

I notice this file in ~/history. It appears now and then. I don't know why. I delete it and there doesn't seem to be any consequence. Anyone know what's up with that?

Thanks.

igadoter · 03-03-2021, 02:42 AM

Use file

Code:

$ file history.db

this should give a hint what app is creating this.

linustalman · 03-06-2021, 01:46 AM

Quote:

Originally Posted by igadoter

Use file

Code:

$ file history.db

this should give a hint what app is creating this.

Hi igadoter. Sorry for the late reply. I deleted the file a few days ago and was waiting for it to appear again.

Output:

Code:

history.db: SQLite 3.x database, last written using SQLite version 3027002

berndbausch · 03-06-2021, 02:48 AM

A very quick google points to Safari, which is rather unlikely on Debian, but perhaps other browsers use a file like this? Also, you could easily look inside using sqlite.

igadoter · 03-06-2021, 04:19 AM

There is is app which is using SQLite. Look through running processes. You should find then guilty. And of course just read the file with SQLite. There is something nice GUI for reading SQLite files. I don't remember now the name. I was using it myself. Of course if you have some time just learn something about SQLite. Can be useful in future.

linustalman · 03-06-2021, 04:42 AM

Quote:

Originally Posted by igadoter

... There is something nice GUI for reading SQLite files. I don't remember now the name. ...

Hey igadoter. Was it 'sqlitebrowser', by any chance?

igadoter · 03-06-2021, 04:49 AM

I really don't remember. But no matter if sqlitebrowser is gui for SQLite - just use it. Now I recalled that app I used was in qt5.

linustalman · 03-06-2021, 04:51 AM

There doesn't seem to be much to go on.

igadoter · 03-06-2021, 05:21 AM

Go through all tabs. Browse other tabs and sure google a little. You see that on that picture there are many strange things, say: "PRAGMA checkpoint_fullfsync" and others. There must be something on internet.

lvm_ · 03-06-2021, 06:17 AM

Trying to figure out what created a file with such generic name and type using only circumstantial evidence is often a fruitless task. If you want to know, install audit package, set up a watch (auditctl -w ~/history/history.db -p war) and after this file has been created check who was the culprit (ausearch -f ~/history/history.db)

igadoter · 03-06-2021, 06:29 AM

Are you sure audit system still exists? I found this https://linux.die.net/man/8/auditctl but it is for 2.6 kernel. I am running Devuan with 4.19 kernel and there is no such tool like auditctl. Perhaps there is something similar but starting point is to look for what is nowadays audit system in kernel. I mean it is kernel feature not a tool.

Edit: I missed correct package. Here is listed as autitd. Yet description reads

Quote:

The audit package contains the user space utilities for
storing and searching the audit records generated by
the audit subsystem in the Linux 2.6 kernel.

Edit: I feel like idiot now. All pragma statements are SQLite internals.

igadoter · 03-06-2021, 07:09 AM

I am sorry to tell but google says history.db is also used by Safari browser. So if you are running Safari then essentially we are wasting our time here. Trying to resolve something which does not need to be resolved.

berndbausch · 03-06-2021, 12:06 PM

Quote:

Originally Posted by igadoter

Are you sure audit system still exists? .

It does.

igadoter · 03-06-2021, 01:22 PM

Thanks. I found this arch wiki https://wiki.archlinux.org/index.php/Audit_framework

linustalman · 03-07-2021, 06:46 AM

Quote:

Originally Posted by lvm_

Trying to figure out what created a file with such generic name and type using only circumstantial evidence is often a fruitless task. If you want to know, install audit package, set up a watch (auditctl -w ~/history/history.db -p war) and after this file has been created check who was the culprit (ausearch -f ~/history/history.db)

I don't have the audit package on my system.