Changing binaries
Dear all, I've just inherited a debian system. I'm affraid I'm not very experienced with Debian, coming more from a Solaris background so please be patient if the questions are numpty.
I have a problem at the moment, strangely various binaries in the /bin directory are changing size and becoming corrupt. When I restore the original they work ok, and then at some time later they change size and stop working. I've now restored all of the files (there's about a dozen) into /bin2 which I can use when the ones in /bin get corrupt. The original (and working file in /bin2 is as follows:
/bin2/ls -l /bin2/ls
-rwxr-xr-x 1 root root 75948 Jul 31 17:17 /bin2/ls
but the one in /bin is different ie
/tmp/ls -al /bin/ls
-rwxr-xr-x 1 root root 80044 Jul 31 21:29 /bin/ls
As you can see it changed size recently tonight. Looking in /bin all of the following files are also larger
than they were and have all changed size at the same time:
-rwxr-xr-x 1 root root 80044 Jul 31 21:29 vdir
-rwxr-xr-x 1 root root 34456 Jul 31 21:29 touch
-rwxr-xr-x 1 root root 9716 Jul 31 21:29 tempfile
-rwxr-xr-x 1 root root 16312 Jul 31 21:29 sync
-rwxr-xr-x 1 root root 17944 Jul 31 21:29 rmdir
-rwxr-xr-x 1 root root 34808 Jul 31 21:29 rm
-rwxr-xr-x 1 root root 17944 Jul 31 21:29 readlink
-rwxr-xr-x 1 root root 9672 Jul 31 21:29 mktemp
-rwxr-xr-x 1 root root 23276 Jul 31 21:29 mknod
-rwxr-xr-x 1 root root 24984 Jul 31 21:29 mkdir
-rwxr-xr-x 1 root root 80044 Jul 31 21:29 ls
-rwxr-xr-x 1 root root 27192 Jul 31 21:29 ln
-rwxr-xr-x 1 root root 57772 Jul 31 21:29 gzip
-rwxr-xr-x 1 root root 80044 Jul 31 21:29 dir
-rwxr-xr-x 1 root root 35820 Jul 31 21:29 df
-rwxr-xr-x 1 root root 32684 Jul 31 21:29 dd
-rwxr-xr-x 1 root root 55308 Jul 31 21:29 cp
-rwxr-xr-x 1 root root 38668 Jul 31 21:29 chown
-rwxr-xr-x 1 root root 35308 Jul 31 21:29 chmod
all of them slightly larger than what they should be. When I run the currupt verion of /bin/ls I get the following:
# /bin/ls
Segmentation fault
I've just written a script to watch the files changing so it restores them, but that's no fix at all I've tried to ascertain why they are changing but cannot get to the bottom of it, sometimes it's actually while I'm on the system. Strangley I also have a copy in /tmp that I've had there all day and that's never been corrupted it has same ownership permissions etc as the one in /bin/ls.
Also I've got various commands hanging around in a ps listing,
either supposedly still running or defunct, eg
root 2142 1 0 Jul27 ? 00:00:00 mv ls.corrupt ls
From the other day when this occured, and
root 2143 2142 0 Jul27 ? 00:00:00 [mv] <defunct>
And I have a few hundred lines like this.
Very strange and I'm pulling my hair out at the m oment trying to figure it out. I've not rebooted the system as I'm remote from it and I don't want to take the chance of it not coming back while I'm not there.
As I say I have inherited the system and have no real prior knowledge of the box or what our old admin did on there, so any help greatly appreciated.
Thanks
Reply to: