Erik Knepfler

Member
Sep 2, 2014
19
1
53
Long Beach, California, United States
cPanel Access Level
Root Administrator
I just noticed this file called rc4.txt sitting in /root that is a whopping 22 GB!

The contents look roughly like this:
Code:
rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:rc4.txt:peer1.log:[2016-01-25 03:32:19 -0800]   Installing new rpms: MySQL55-client-5.5.47-1.cp1148.x86_64.rpm MySQL55-devel-5.5.47-1.cp1148.x86_64.rpm MySQL55-server-5.5.47-1.cp1148.x86_64.rpm MySQL55-shared-5.5.47-1.cp1148.x86_64.rpm MySQL55-test-5.5.47-1.cp1148.x86_64.rpm bandmin-1.6.1-11.cp1136.noarch.rpm compat-MySQL50-shared-5.0.96-4.cp1136.x86_64.rpm compat-MySQL51-shared-5.1.73-1.cp1150.x86_64.rpm cpanel-ImageMagick-6.9.0-2.cp1150.x86_64.rpm cpanel-ace-editor-1.1.9-1.cp1152.noarch.rpm cpanel-analog-6.0-2.cp1136.x86_64.rpm cpanel-angular-growl-2-0.7.3-4.cp1150.noarch.rpm cpanel-angular-ui-bootstrap-0.12.0-1.cp1150.noarch.rpm cpanel-angular-ui-bootstrap-devel-0.12.0-1.cp1150.noarch.rpm cpanel-angular-ui-utils-0.1.1-1.cp1146.noarch.rpm cpanel-angularjs-1.2.14-1.cp1140.noarch.rpm cpanel-awstats-7.4-2.cp1136.noarch.rpm cpanel-bindp-1.0.0-1.cp1152.x86_64.rpm cpanel-bootstrap-3.1.1-2.cp1142.noarch.rpm cpanel-bootstrap-devel-3.1.1-2.cp1142.noarch.rpm cpanel-bootstrap-rtl-0.9.16-3.cp1144.noarch.rpm cpanel-bootstrap-rtl-dev
Any idea what this is, how it got here? I assume it's safe to delete but would really like to know more before I do. Googling turned up nothing.

Perhaps I could change some permissions on it to help it self-manage it's size better, rather than deleting it entirely, if it's being used for something?
 
Last edited by a moderator:

cPanelMichael

Administrator
Staff member
Apr 11, 2011
47,909
2,229
463
Hello,

You can check in your /root/.bash_history file to see if it was created at some point, or review your process list to see if any active processes are writing to that file. Also, use a command such as "stat /path/to/filename.txt" to see when it was last created and updated.

Thank you.