Re: /.cache directory

[Karl Vogel <vogelke@pobox.com>]

>> On Fri 03 Oct 2025 at 02:59:47 (-0400), Avinash Sonawane wrote:
> Over the coming weekend I'm planning to install Debian again.  This time
> I'll be using debian-13.1.0-amd64-DVD-1.iso.  What can I do to catch the
> culprit in/after the action?

  As soon as you can login as root, see if /.cache exists.  If it's already
  there, run find to get the modtime for everything:

    find / -printf "%T+ %p\n" | sort > /tmp/TOC

  Your output should include fractional seconds, unless I've misread
  something.  Hopefully you'll see this (hypothetical):

    2025-09-28+02:37:51.2773940000 /
    2025-09-28+02:38:04.0106260000 /tmp
    2025-09-28+02:38:14.8079998750 /proc
    2025-09-28+02:42:31.0863900000 /etc
    2025-09-28+02:44:48.8549970000 /boot
    2025-09-28+02:46:11.8930630000 /dev
    2025-09-28+02:46:22.0544770000 /var
    2025-09-28+02:47:47.7200420000 /.cache    ...

  So it was modified or created after /var was modified or created.
  If there's an install log, that's next.

  If it's not there, do one install step at a time and start a shell
  whenever you can.  If it's not there but shows up after you've been at
  multiuser for awhile, get the timestamp and see if anything's in your
  cronlog or syslog.

-- 
Karl Vogel                      I don't speak for anyone but myself

I am not a 32 year old woman.       --written on blackboard by Bart Simpson