<SOLVED> Confusing contents of /var folder

[WharfRat]

This is a strange one that I just stumbled upon

https://gist.github.com/8e1787cd348600f ... 06e25f08a9

The link is the result of ls -lh /var|pastebin

I seem to have /proc /dev /etc/ /bin and who knows what other folders' contents are being listed there

The getfacl file shows in /var and /bin

Code: Select all

[bill@XPS] ~ $ locate getfacl | while read l;do ls -lh "$l";done
-rwxr-xr-x 1 root root 24K 2016-02-07 06:10:27 /bin/getfacl*
lrwxrwxrwx 1 root root 12 2016-09-27 19:06:52 /usr/bin/getfacl -> /bin/getfacl*
-rw-r--r-- 1 root root 2.7K 2016-02-07 06:10:23 /usr/share/man/man1/getfacl.1.gz
-rwxr-xr-x 1 root root 24K 2016-02-07 06:10:27 /var/getfacl*
[bill@XPS] ~ $ 

I'm stumped so If anyone has a clue

[catweazel]

It might be disk corruption. To cut a short story long, I had something similar happen just last week. The 4k files are the give away. I accidentally unplugged my server during a backup and mdadm spewed its guts all over the show, causing the hot spare and one of a RAID10 disks to become part of a RAID0 array and one of the RAID0 disks became part of the RAID10 array. Nothing was recoverable, all that was left was hundreds of 4k files and directories with numbers for names, a total mess.

[Pjotr]

No answer, but just for comparison with a healthy system, this is what it says on my machine:
https://gist.github.com/anonymous/5968a ... 1e4d127dd6

36 K, compared to the 64 M on your machine.... That does look a bit fishy.

[WharfRat]

Thanks Pjotr and catweazel

My first thought was corruption too. I took the partition offline and those file are static.

I ran fsck and the contents remained the same.

I noticed a lot of that junk is from September, but I don't recall doing anything that would dump files to /var

Over the next few days I'm going to slowly delete those extraneous files too see what happens and see if they reappear.

Worse comes to worse sylvia claims the partition

[FreedomTruth]

Also concerning is you don't seem to have any of the normal /var contents (/var/cache, /var/lib, /var/local, /var/log ...)
What's the result of locate kern.log? Hopefully you have your real /var files somewhere.

[WharfRat]

Those files/folders are there. They're just buried in all the junk that accumulated

Code: Select all

[bill@XPS] /var $ ls -lhd {log,cache,local,mail,lib}
drwxr-xr-x 16 root root   4.0K 2017-03-21 23:52:15 cache/
drwxr-xr-x 75 root root   4.0K 2017-08-11 09:09:36 lib/
drwxrwsr-x  2 root staff  4.0K 2016-04-12 16:14:23 local/
drwxrwxr-x 14 root syslog 4.0K 2017-11-15 08:10:59 log/
drwxrwsr-x  2 root mail   4.0K 2016-06-28 08:53:05 mail/
[bill@XPS] /var $ locate kern.log
/var/log/kern.log
/var/log/kern.log.1
/var/log/kern.log.2.gz
/var/log/kern.log.3.gz
/var/log/kern.log.4.gz
[bill@XPS] /var $ 
 

[WharfRat]

I slowly removed all the extraneous files/junk from /var/ and it looks like it's back to normal

Code: Select all

[bill@XPS] ~/script $ ls -lh /var
total 40K
drwxr-xr-x  2 root root   4.0K 2017-11-17 07:24:24 backups/
drwxr-xr-x 16 root root   4.0K 2017-03-21 23:52:15 cache/
drwxr-xr-x 75 root root   4.0K 2017-08-11 09:09:36 lib/
drwx------  3 root root   4.0K 2017-09-20 08:11:56 lock/
drwxrwxr-x 14 root syslog 4.0K 2017-11-17 07:24:25 log/
drwx------  2 root root   4.0K 2017-09-03 12:18:45 lost+found/
drwxrwsr-x  2 root mail   4.0K 2016-06-28 08:53:05 mail/
drwxr-xr-x  2 root root   4.0K 2017-11-15 14:14:44 opt/
drwxr-xr-x  7 root root   4.0K 2016-06-28 09:17:55 spool/
drwxrwxrwt 25 root root   4.0K 2017-11-17 07:19:53 tmp/
lrwxrwxrwx  1 root root      6 2017-11-16 08:10:57 run -> ../run/
[bill@XPS] ~/script $ 

I don't know how this happened, but I'm sure it was something I did