The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

huge 22GB rc4.txt file in /root

Discussion in 'General Discussion' started by Erik Knepfler, May 24, 2016.

  1. Erik Knepfler

    Erik Knepfler Member

    Joined:
    Sep 2, 2014
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Long Beach, California, United States
    cPanel Access Level:
    Root Administrator
    I just noticed this file called rc4.txt sitting in /root that is a whopping 22 GB!

    The contents look roughly like this:
    Code:
    rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:peer1.log:[2016-01-25 03:32:19 -0800]   Installing new rpms: MySQL55-client-5.5.47-1.cp1148.x86_64.rpm MySQL55-devel-5.5.47-1.cp1148.x86_64.rpm MySQL55-server-5.5.47-1.cp1148.x86_64.rpm MySQL55-shared-5.5.47-1.cp1148.x86_64.rpm MySQL55-test-5.5.47-1.cp1148.x86_64.rpm bandmin-1.6.1-11.cp1136.noarch.rpm compat-MySQL50-shared-5.0.96-4.cp1136.x86_64.rpm compat-MySQL51-shared-5.1.73-1.cp1150.x86_64.rpm cpanel-ImageMagick-6.9.0-2.cp1150.x86_64.rpm cpanel-ace-editor-1.1.9-1.cp1152.noarch.rpm cpanel-analog-6.0-2.cp1136.x86_64.rpm cpanel-angular-growl-2-0.7.3-4.cp1150.noarch.rpm cpanel-angular-ui-bootstrap-0.12.0-1.cp1150.noarch.rpm cpanel-angular-ui-bootstrap-devel-0.12.0-1.cp1150.noarch.rpm cpanel-angular-ui-utils-0.1.1-1.cp1146.noarch.rpm cpanel-angularjs-1.2.14-1.cp1140.noarch.rpm cpanel-awstats-7.4-2.cp1136.noarch.rpm cpanel-bindp-1.0.0-1.cp1152.x86_64.rpm cpanel-bootstrap-3.1.1-2.cp1142.noarch.rpm cpanel-bootstrap-devel-3.1.1-2.cp1142.noarch.rpm cpanel-bootstrap-rtl-0.9.16-3.cp1144.noarch.rpm cpanel-bootstrap-rtl-dev
    
    
    Any idea what this is, how it got here? I assume it's safe to delete but would really like to know more before I do. Googling turned up nothing.

    Perhaps I could change some permissions on it to help it self-manage it's size better, rather than deleting it entirely, if it's being used for something?
     
    #1 Erik Knepfler, May 24, 2016
    Last edited by a moderator: May 24, 2016
  2. cPanelMichael

    cPanelMichael Forums Analyst
    Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    30,723
    Likes Received:
    660
    Trophy Points:
    113
    cPanel Access Level:
    Root Administrator
    Hello,

    You can check in your /root/.bash_history file to see if it was created at some point, or review your process list to see if any active processes are writing to that file. Also, use a command such as "stat /path/to/filename.txt" to see when it was last created and updated.

    Thank you.
     
  3. Erik Knepfler

    Erik Knepfler Member

    Joined:
    Sep 2, 2014
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Long Beach, California, United States
    cPanel Access Level:
    Root Administrator
    Nothing in bash history, created April 21 2016, appears to have only been accessed by me. I guess just a rogue log. Moved to rc4-hold.txt for a while and will see if a new one is created.
     
Loading...

Share This Page