Directory named \t\t\t\t at root of filesystem after update

[Oriso]

Hello everyone,

We've been running CPanel on a server for many years now, and at the beginning of this year, installed a backup solution that acts as an offline backup solution for us. We've had errors in our backups appearing in the beginning of october, coinciding closely to our update of CPanel to version 11.

When /scripts/upcp is run, it seems to create a folder, at / level named \t\t\t\t in bash, or other names in other shells. We ended up aware of that cuz our backup solution couldn't backup the folder.

If I run upcp manually, I also get the folder back (I managed to delete it using fish:// in Konqueror). I did not see any errors in my log of upcp that would indicate why this folder is created. I obviously want to see my backup logs with no error, and as this is the only error, I wish to resolve it.

Anyone has ever seen this problem before? Search on the forum did not give me much so far.

Thanks,

Alain

[concreteman]

yeah, my new folder is called ???? or looks like line returns on another. I delete them and they come back like magic

[daveformerlyof]

I haven't seen this occur on our test systems. What version of cP/WHM are you running?

[concreteman]

WHM 11.11.0 cPanel 11.15.0-E17700
REDHAT 9 i686 on standard - WHM X v3.1.0

Happened on a current build actually and hasn't gone away. I'de be willing to discuss it with support, but their response to my last 2 tickets were not too impressive.

[cPanel tickets ID# 220202] Re: Unable to access outside servers

[cPanel tickets ID# 219968] Re: CP 11 Up broke bind

[cpanelkenneth]

Are you both using the same third party backup solution? Do you have any idea *where* during the upcp process the strange folder gets created? Check the logs in /var/cpanel/updatelogs for that info (if it gets logged).

[concreteman]

Are you both using the same third party backup solution? Do you have any idea *where* during the upcp process the strange folder gets created? Check the logs in /var/cpanel/updatelogs for that info (if it gets logged).

I do standard backups using CPbackup, Problem isn't backups it's the root level folder created that is causing his errors. If that were my only error I would be tickled. I did notice when I removed my ???? folder, it was recreated at 12:03AM which is when I got updates. I deleted it again and will see when it comes back.

At the moment I have other issues I am dealing with after Apache 2.2up, like nearly identical sites, with identical configs (php). One works/other doesn't. Or the site that did work after the upgrade and doesn't now throwing 500's traced to bad Zend but the downgrade failed, so I'll do it by hand again. Or CPanel claiming I'm still using mbox, so I run the script again and pray people don't end up with dups again.

I'de get less calls about changing stuff than I get about stuff not working as expected. Most people set it and forget it anyway. I almost like Cpanel when it works, but dread updates. They stay behind on updating, then there's still problems, I'll quit complaining before it gets ugly.

Here is one of my logs, the names were changed to protect the inocent (this came in about the same time the folder was created)...

Checking and Repairing System Package Setup......Done
Setting up ip startup......Done
Configuring editors......Done
Creating symlinks for common binaries......Done
Setting Clock......Done
Running Env Auto Repair...quota test: repquota exited with signal 0 (ok)
Requesting script ... Done
Auto Repair is running...
io_compress_gzip has already been run.

spamd_dbm_fix has already been run.
...Auto Repair is done.
...Done
Running Cleanups...Setting up suspended page for user servers (missing)...Done
Found hostname to be sf1.xxx.com, which resolves to xxx.xxx.xx.xx
Hostname Virtual Host is already setup
...Done
Updating services & databases...PHP version file is up to date
Ftp Quota Check v1.6
Updating xxx: ...Done
Updating xxx: ...Done
Updating xxx: ...Done
Updating xxx: ...Done
Updating xxx: ...Done
Updating xxx: ...Done
...Done
Cpanel updates are coming from layer2.cpanel.net
Setting Up Crontab......Done
Setting Up dcpumon Crontab......Done
Repairing Mailman Permissions......Done
Running Sanity Checks & Notifications...findutils passes checksum
net-tools passes checksum
SENT ipcheck email
Notification => admin@servers.com via EMAIL [level => 2]
...Done
Running Named Checks......Done
Updating Virus Patterns......Done
Restoring compiler permissions...Compilers are enabled for unprivileged users.
...Done
Repairing mysql......Done
Optimizing Databases......Done
Added Contact admin@servers.com
Loading Symbol Table... /usr/local/cpanel/etc/sym/BitchX.sym ..Done
Loading Symbol Table... /usr/local/cpanel/etc/sym/bnc.sym ..Done
Loading Symbol Table... /usr/local/cpanel/etc/sym/eggdrop.sym ..Done
Loading Symbol Table... /usr/local/cpanel/etc/sym/generic-sniffers.sym ..Done
Loading Symbol Table... /usr/local/cpanel/etc/sym/guardservices.sym ..Done
Loading Symbol Table... /usr/local/cpanel/etc/sym/ircd.sym ..Done
Loading Symbol Table... /usr/local/cpanel/etc/sym/psyBNC.sym ..Done
Loading Symbol Table... /usr/local/cpanel/etc/sym/ptlink.sym ..Done
Loading Symbol Table... /usr/local/cpanel/etc/sym/services.sym ..Done
Kill Proc Enabled
Rebuilding Process List...Done
Scanning for new mail senders......Done
Scanning suexec_log.Done

[heyjohnboy]

We found the same \t\t\t\t folder the very next day after upgrading a server from 10.8 to 11.1. Unfortunately, we were dealing with a hack that day as well, and didn't put 2 and 2 together to understand that is was a benign folder created by cpanel. So one of our techs tried desperately to delete it (it can't be accessed using bash) and when he succeeded in deleting it using an FTP client, it proceeded to delete the ENTIRE /boot directory. Needless to say, what followed was an unplanned weekend scrambling to move all of the accounts on that box to a different server.

In the process of restoring the backups we also discovered that the MySQL DBs of two or three sites were corrupted IN THE BACKUP. Is there any provision for notifying the server admin when a backup errors out like it apparently did on these few accounts? If we had found this out after a failure of the primary data it would have been a far worse experience.

[concreteman]

ouch, that hurts... unless there is a reason you can't have the folder there, I would leave it. It doesn't seem to be a kit of any sort but I think with your config it will be back. I have been able to remove the folder a few times with mc but it hasn't caused me any problems. Glad I didn't try scp on it, I'm having enough problems.

[daveformerlyof]

Is this only happening on RedHat 9, or are people experiencing this on other OSes as well?

[yurster]

I have servers running RHES 3 and I have the same folders. I don't have it on my RHES 4 servers.

[daveformerlyof]

Are there any files in the directory? What are the permissions and ownership of the directory and any files? If there are any files in that directory, does lsof show any of them as open?

[yurster]

Owner of folder is root. I'm not sure how to view the files in it from bash. any suggestions?

[daveformerlyof]

Owner of folder is root. I'm not sure how to view the files in it from bash. any suggestions?

can you:

cd /
ls -la
cd \t\t\t\t
ls -la
lsof

can you paste the output of the first 4, you can pm me the lsof output if you're not comfortable with pasting the filenames here.

Thanks

[yurster]

I get "No such file or directory"

I even tried escaping the slashes "cd \\t\\t\\t\\t" still didn't work.

[daveformerlyof]

I get "No such file or directory"

I even tried escaping the slashes "cd \\t\\t\\t\\t" still didn't work.

Can you try and tab complete the name of the directory in bash. Try typing a single \t and then hitting tab, or combinations of escaped slashes.