Log entries posting as Directorys in /var/www !!!!

Discussion in 'Installation/Configuration' started by rojozak, Nov 29, 2006.

  1. rojozak

    rojozak New Member

    Log entries posting as Directories in /var/www !!!!

    I just recently cleared up a problem with logs not posting...some error with syslog and a bandwidth monitor in cron from webmin.

    But this has shown me a much larger problem. This is very very strange. My log entries are now posting as directories in /var/www. I have no idea where to start looking for this.

    Here is a snip of the directory with a ls -la /var/www command:

    Code:
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:02:58 mail postfix
    drwxr-xr-x    4 root       root   4096 2006-11-29 00:30 Nov 29 00:03:00 mail postfix
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:03:01 mail postfix
    drwxr-xr-x    4 root       root   4096 2006-11-29 00:30 Nov 29 00:03:02 mail postfix
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:03:07 mail postfix
    drwxr-xr-x    4 root       root   4096 2006-11-29 00:30 Nov 29 00:03:08 mail postfix
    drwxr-xr-x    4 root       root   4096 2006-11-29 00:30 Nov 29 00:03:09 mail postfix
    drwxr-xr-x    4 root       root   4096 2006-11-29 00:30 Nov 29 00:03:21 mail postfix
    drwxr-xr-x    4 root       root   4096 2006-11-29 00:30 Nov 29 00:03:30 mail postfix
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:09:01 mail CRON[26300]: (pam_unix) session opened for user root by (uid=0)?
    
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:30:01 mail CRON[27101]: (pam_unix) session opened for user otrs by (uid=0)?
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:30:01 mail CRON[27103]: (pam_unix) session opened for user otrs by (uid=0)?
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:30:02 mail CRON[27105]: (pam_unix) session opened for user root by (uid=0)?
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:30:03 mail
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:30:03 mail CRON[27104]: (pam_unix) session opened for user root by (uid=0)?
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:30:04 mail
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:30:07 mail
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:30:08 mail CRON[27104]: (pam_unix) session closed for user root?
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:30:08 mail postfix
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:30:19 mail postfix
    drwxr-xr-x    3 root       root   4096 2006-11-29 00:30 Nov 29 00:30:22 mail postfix
    lrwxrwxrwx    1 root       root     21 2006-09-29 23:15 phpmyadmin -> /usr/share/phpmyadmin
    drwxr-xr-x    2 root       root   4096 2006-09-23 21:17 sharedip
    drwxr-xr-x    9 web2_admin web2   4096 2006-11-25 22:59 web2
    drwxr-xr-x   10 web4_admin web4   4096 2006-11-25 22:59 web4
    drwxr-xr-x    8 www-data   web5   4096 2006-10-18 04:00 web5
    drwxr-xr-x    8 www-data   web6   4096 2006-11-10 04:00 web6
    drwxr-xr-x    2 root       root   4096 2006-09-17 20:47 webalizer
    lrwxrwxrwx    1 www-data   web4     13 2006-09-29 16:48 www.xxxx.net -> /var/www/web4
    lrwxrwxrwx    1 www-data   web2     13 2006-09-24 14:36 www.xxxx.com -> /var/www/web2
    lrwxrwxrwx    1 www-data   web5     13 2006-10-17 16:15 www.xxxxx.net -> /var/www/web5
    lrwxrwxrwx    1 www-data   web2     13 2006-09-24 14:34 www.xxxxx.com -> /var/www/web2
    lrwxrwxrwx    1 www-data   web6     13 2006-11-09 15:06 www.xxxxxx.com -> /var/www/web6
    
    Does anyone have any idea how to go about finding the cause of this? Has anyone ever seen this before?

    It spans almost a 24 hour period. There are many many more "posts" in the directory besides these I've snipped...

    Thanks.
     
    Last edited: Nov 29, 2006
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    I have no idea, this looks really strange. Have you thought about reinstalling the server?
     
  3. rojozak

    rojozak New Member

    Wow....something looking strange in your view concerns me. I wasn't thinking this was all that critical and was hoping there might be some things to check before a rebuild?

    I did find that these "directories" were all created at 0:30 on the day following the date of the log entry it is named for. There were about 1700 directories created and most had a subdirectory named for the year (2006) and an empty file in there called web.log (i *think* that was the name).

    After checking my crontab...only 2 jobs run at 0:30....both being ISPConfig entries.

    Any ideas?
     
  4. falko

    falko Super Moderator Howtoforge Staff

    I, too, think this is looking strange.
    Which distribution do you use? Did you use one of the tutorials on HowtoForge to set up the system?
     

Share This Page