Log entries posting as Directories in /var/www !!!! I just recently cleared up a problem with logs not posting...some error with syslog and a bandwidth monitor in cron from webmin. But this has shown me a much larger problem. This is very very strange. My log entries are now posting as directories in /var/www. I have no idea where to start looking for this. Here is a snip of the directory with a ls -la /var/www command: Code: drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:02:58 mail postfix drwxr-xr-x 4 root root 4096 2006-11-29 00:30 Nov 29 00:03:00 mail postfix drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:03:01 mail postfix drwxr-xr-x 4 root root 4096 2006-11-29 00:30 Nov 29 00:03:02 mail postfix drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:03:07 mail postfix drwxr-xr-x 4 root root 4096 2006-11-29 00:30 Nov 29 00:03:08 mail postfix drwxr-xr-x 4 root root 4096 2006-11-29 00:30 Nov 29 00:03:09 mail postfix drwxr-xr-x 4 root root 4096 2006-11-29 00:30 Nov 29 00:03:21 mail postfix drwxr-xr-x 4 root root 4096 2006-11-29 00:30 Nov 29 00:03:30 mail postfix drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:09:01 mail CRON[26300]: (pam_unix) session opened for user root by (uid=0)? drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:30:01 mail CRON[27101]: (pam_unix) session opened for user otrs by (uid=0)? drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:30:01 mail CRON[27103]: (pam_unix) session opened for user otrs by (uid=0)? drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:30:02 mail CRON[27105]: (pam_unix) session opened for user root by (uid=0)? drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:30:03 mail drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:30:03 mail CRON[27104]: (pam_unix) session opened for user root by (uid=0)? drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:30:04 mail drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:30:07 mail drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:30:08 mail CRON[27104]: (pam_unix) session closed for user root? drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:30:08 mail postfix drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:30:19 mail postfix drwxr-xr-x 3 root root 4096 2006-11-29 00:30 Nov 29 00:30:22 mail postfix lrwxrwxrwx 1 root root 21 2006-09-29 23:15 phpmyadmin -> /usr/share/phpmyadmin drwxr-xr-x 2 root root 4096 2006-09-23 21:17 sharedip drwxr-xr-x 9 web2_admin web2 4096 2006-11-25 22:59 web2 drwxr-xr-x 10 web4_admin web4 4096 2006-11-25 22:59 web4 drwxr-xr-x 8 www-data web5 4096 2006-10-18 04:00 web5 drwxr-xr-x 8 www-data web6 4096 2006-11-10 04:00 web6 drwxr-xr-x 2 root root 4096 2006-09-17 20:47 webalizer lrwxrwxrwx 1 www-data web4 13 2006-09-29 16:48 www.xxxx.net -> /var/www/web4 lrwxrwxrwx 1 www-data web2 13 2006-09-24 14:36 www.xxxx.com -> /var/www/web2 lrwxrwxrwx 1 www-data web5 13 2006-10-17 16:15 www.xxxxx.net -> /var/www/web5 lrwxrwxrwx 1 www-data web2 13 2006-09-24 14:34 www.xxxxx.com -> /var/www/web2 lrwxrwxrwx 1 www-data web6 13 2006-11-09 15:06 www.xxxxxx.com -> /var/www/web6 Does anyone have any idea how to go about finding the cause of this? Has anyone ever seen this before? It spans almost a 24 hour period. There are many many more "posts" in the directory besides these I've snipped... Thanks.
Wow....something looking strange in your view concerns me. I wasn't thinking this was all that critical and was hoping there might be some things to check before a rebuild? I did find that these "directories" were all created at 0:30 on the day following the date of the log entry it is named for. There were about 1700 directories created and most had a subdirectory named for the year (2006) and an empty file in there called web.log (i *think* that was the name). After checking my crontab...only 2 jobs run at 0:30....both being ISPConfig entries. Any ideas?
I, too, think this is looking strange. Which distribution do you use? Did you use one of the tutorials on HowtoForge to set up the system?
