[SOLVED] Funny file crontab.vlsrut

newbie14 · 11-24-2013, 08:41 PM

I saw this file crontab.vlsrut in my /tmp with date 1/1/1970. I tried to google about it could not find. Any idea what is this file ?

unSpawn · 11-25-2013, 01:40 AM

Run 'stat' on the file, then 'strings -an1' and post the output.

newbie14 · 11-25-2013, 05:58 AM

Dear Unspawn,
Below is the results you required.

Quote:

stat crontab.vlSrUt
File: `crontab.vlSrUt'
Size: 0 Blocks: 0 IO Block: 4096 regular empty file
Device: fd00h/64768d Inode: 1703944 Links: 1
Access: (0600/-rw-------) Uid: ( 500/ myuser) Gid: ( 500/ myuser)
Access: 2013-11-25 10:31:14.493986261 +0800
Modify: 1970-01-01 07:30:00.000000000 +0730
Change: 2013-05-18 18:06:54.499722156 +0800

strings -an1 crontab.vlSrUt gives me empty as I check the file is empty. I also checked crontab -e under this myuser is empty too and even after sudo -i is empty.

unSpawn · 11-25-2013, 12:00 PM

I confirm the temporary crontab file, as you would edit it via 'crontab -e', has a mtime of 1970. Probably broke off the edit so the temporary file remains. As it's empty you could delete it or it should be removed by 'tmpwatch' if installed and if so configured.

sundialsvcs · 11-25-2013, 01:01 PM

Agree. Many apps will generate files with a "temporary name," sometimes adding a random suffix (e.g. "vlsrut" could be a random string) because the temporary-files area in Linux is usually global. If the program dies, the file might be left behind. Nothing in this scenario, absent some other indication, is setting off warning-bells with me so far.

newbie14 · 11-25-2013, 08:24 PM

Dear Unspawn,
Thank you for the confirmation was kind of worried because I google and could not fine any information on the file extension. IS tmpwatch an internal centos programme or should I install it? So it means that I have have started the crontab -e and just shut if off half way so this the cause of it can I confirm that?

newbie14 · 11-25-2013, 08:26 PM

Dear Sundialcvs,
Thank you for the input because I could not google on the file extension got me worried. What do you mean by temporary-files area in Linux is usually global ?

unSpawn · 11-26-2013, 03:48 PM

Quote:

Originally Posted by newbie14

IS tmpwatch an internal centos programme or should I install it?

Next time do make an effort please:

Code:

apropos tmpwatch || yum info tmpwatch

Quote:

Originally Posted by newbie14

So it means that I have have started the crontab -e and just shut if off half way so this the cause of it can I confirm that?

It may be, yes.

newbie14 · 11-26-2013, 08:44 PM

Dear Unspawn,
Sorry for that I am already googling it for some information it. I kind of learning a lots of new stuff and agree with what you told me earlier that security is an on going thing.