0

Today i came to work, and found that some of my perl scripts on work server - do not run. The problem is that scripts can not find some libraries that need to work. However, just yesterday, these libraries have been installed and scripts worked! It seems that packages have been removed from the system! After reviewing the logs i found this record in /var/log/apt/history.log

Start-Date: 2014-09-26 06:10:33 Remove: libclass-load-perl:amd64 (0.17-1), rrdtool:amd64 (1.4.7-2), libyaml-syck-perl:amd64 (1.20-1),... SKIPED OTHER MOSTLY PERL PACKGES End-Date: 2014-09-26 06:10:41

BUT!

1 There was no one on the server at this time, and no one would remove these packages.

2.Maybe the server was hacked, but first obvious signs of hacking is not visible, and secondly very strange that attacker would decided to remove these packages

3 All other entries in /var/log/apt/history.log - also have another string CommandLine: - and in this case it absent.

What could have happened?

UPDATE:

A week before (2014-09-19) I have purged munin (but not munin-node!) . Maybe this removed packages is autoremove suggestion for munin ? But as i know 'autoremove' is not really 'auto' and it needs manual verification before delete something

UPDATE2:

  1. unattended-upgrades - not installed
  2. /etc/apt/apt.conf.d/01autoremove
APT
{
  NeverAutoRemove
  {
        "^firmware-linux.*";
        "^linux-firmware$";
        "^linux-image.*";
        "^kfreebsd-image.*";
        "^linux-restricted-modules.*";
        "^linux-ubuntu-modules-.*";
        "^gnumach$";
        "^gnumach-image.*";
  };

  Never-MarkAuto-Sections
  {
        "metapackages";
        "restricted/metapackages";
        "universe/metapackages";
        "multiverse/metapackages";
        "oldlibs";
        "restricted/oldlibs";
        "universe/oldlibs";
        "multiverse/oldlibs";
  };
};
7
  • You have any configuration management system that synchronizes updates/packages etc between servers? – Brian Sep 26 '14 at 10:58
  • No, just default debian apt configuration. – Methyl Sep 26 '14 at 11:01
  • have you installed unattended-upgrades ? please post the file /etc/apt/apt.conf.d/01autoremove – Max Muster Sep 26 '14 at 11:09
  • this smells like ubuntu. – Max Muster Sep 26 '14 at 11:11
  • @eichertc update my post with /etc/apt/apt.conf.d/01autoremove content. And this is not ubuntu, it is Debian Wheezy – Methyl Sep 26 '14 at 11:25
0

You may have some kind of automatic update solution working, which removes "unused" packages.

When apt finds that there is a package which is not used by other packages, then it is considered "unused" and removed.

If you use unattended-upgrade program for automatic updates, try to set Remove-Unused-Dependencies to true.

2
  • I don't install/configure any automatic update system. But maybe modern debian wheezy distro have some default configuration for this ? Where i can check this ? – Methyl Sep 26 '14 at 11:28
  • Check if you have unattended-upgrades installed. If yes, take a look at /etc/apt/apt.conf.d/50unattended-upgrades file. – kazy Sep 27 '14 at 11:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.