[vox-tech] Mysteriously Expanding Home Directory

[Richard Crawford]

Here's the scoop.

I'm running RH 7.2, kernel 2.4.7-10.  My box had been up and running for
two weeks solid, no problems.  A couple of days ago I installed some
programs using Ximian's Red Carpet program and up2date; one of the
up2date packages was a kernel update, but I'm not sure if that's
relevant.

Hm, I also installed Open Office this morning.

Today I went away for several hours.  When I came back, I found a
message that told me my MUA (Evolution) was unable to retrieve my
messages from my mailspool because my device was full.  Confused, I ran
df -h and found that /home was full to capacity, at 100%.  I deleted
some software and removed a couple of old user directories, and had the
/home directory at 96%.  Then I went to watch a movie, and when I came
back, /home was back up at 100%.

Reluctantly I rebooted the computer, just on a whim.  The bootup process
noted some corrupted files and I had to run fsck / as root to fix the
broken files.  When the system was up and running again, I found that I
had to reconfigure Evolution for some reason, as if it had lost my user
information.  All of my mailboxes and filters as well as old e-mails and
contact and calendar information were in place still, fortunately.  I
also ran df -h again and saw that /home is back down to 44%.

I've checked the history file for root and my personal account, and
nothing seems out of the ordinary.  I've checked "who" and "past" and
find nothing untoward.

My first thought was some sort of odd DoS attack (based only on
something I read in one of my Linux books which suggested that a DoS
attack could overwhelm your hard drive), but the fact that the df -h
shows /home at 44% after rebooting suggests otherwise to my relatively
inexperienced mind.  I've looked through my system logs and run dmesg,
but, to be honest, I'm not entirely sure what I'm looking for.



-- 
Slainte,
Richard S. Crawford

mailto:rscrawford@mossroot.com		http://www.mossroot.com
AIM:  Buffalo2K   ICQ: 11646404  Yahoo!: rscrawford
MSN:  underpope@hotmail.com

"It is only with the heart that we see rightly; what is essential is
invisible to the eye."  --Antoine de Saint Exupery

vi vi vi - the editor of the beast