Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've been working on a problem with a /dev/null file on an AIX system (just for background it looks as though it was inadvertently deleted and recreated as a normal file by somebody), but in trying to determine what caused the problem, I noticed that the timestamp on it seems to update every minute. I've observed this on several AIX servers at my workplace.

At present I can't entirely rule out this be something specific to the Application being used at my workplace, so I compared with CentOS and Debian based computers at home last night.

The CentOS box, which runs 24 hours, had a mod time on /dev/null of around 4 days ago (during which time it was essentially just being used as a web browser and multimedia player, although it would have had active but essentially unused Apache, MySQL and VMM processes running in the background).

The timestamp on /dev/null on the Debian machine, which was a just booted laptop, pretty much reflected the boot time, but I tested redirecting STDIN from, and STDOUT to it, and the modification time was unchanged (I'm not sure 100% sure if directing data to /dev/null constitutes "writing to it" in the way it would a normal file).

So my question is essentially, could anybody please offer any advice with regards to what circumstances (permissions changes etc.. aside) might cause the timestamp on /dev/null to update?

Thanks very much for any suggestions.

Alex.

share|improve this question
    
Does AIX have an audit system that you can enable and use to get a log of what/who is changing the file when ? –  Iain Oct 18 '13 at 15:55

1 Answer 1

So my question is essentially, could anybody please offer any advice with regards to what circumstances (permissions changes etc.. aside) might cause the timestamp on /dev/null to update?

On most systems I'm familiar with, exactly the same circumstances that would cause the timestamp on any file to update: Creation (updates ctime), Access (updates atime), or Modification (updates mtime).

  • Creation should only happen once, when the device node is created.
  • Access should really only happen in conjunction with Modification in this case(nobody is going to READ /dev/null....)
  • Modification happens every time someone pipes output to /dev/null.

I've no idea why your Debian system doesn't behave this way (though I've verified that the Ubuntu machine on my desk doesn't update the times on /dev/null when I send output there, so it's almost certainly a Linux/Debian thing related to their implementation of devfs).

Your AIX systems should faithfully update times on devices when they're accessed - including /dev/null. BSD (FreeBSD 9.x) behaves similarly, and I believe Solaris does as well but I don't have a Solaris box to test on.


The bigger question you should be asking is "What idiot deleted /dev/null?!" so you can find them and make an example out of them (and obviously if you haven't already you should remove the regular-file /dev/null and recreate the proper device node. A reboot is probably also in order since some programs may be holding the regular-file /dev/null inode open and still writing to it...).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.