0

I have a Joomla based website running on CentOS, Apache, PHP, MySQL. I am using plupload file uploader to upload the files. I'm uploading the files to /tmp/uploads directory where they are processed and then moved.

For some reason and for the life of me I can't figure out - the /tmp/uploads directory keeps getting deleted. I've checked all the relevant scripts and theres no way they could be deleting the directly (as far as I'm aware). I'm even checking to see if the target file is a directory before moving.

So I started using audit http://www.cyberciti.biz/tips/linux-audit-files-to-see-who-made-changes-to-a-file.html - to try and find out what's causing the delete but as far as I can tell it doesn't really tell me what's deleting the folder.

I've omitted the correct paths and the username for security. You can see on the first audit line it appears to move the file successfully, then on the second audit line it's trying to move from (null) - then the folder cannot be accessed. It doesn't specifically tell me what caused the delete. The command for the audit was

auditctl -w /web/directory/tmp -p wrxa -k tmp-folder

Below is the audit.

----
type=PATH msg=audit(26/03/15 03:30:52.474:104290472) : item=3 name=/files/are/moved/to/1427355052-rainyway---walkin.mp3 inode=282198245 dev=08:11 mode=file,644 ouid=username ogid=username rdev=00:00 nametype=CREATE 
type=PATH msg=audit(26/03/15 03:30:52.474:104290472) : item=2 name=/web/directory/tmp/uploads/p19haf3bbi1ro21eip1s3ck0p1iaha.mp3 inode=282198245 dev=08:11 mode=file,644 ouid=username ogid=username rdev=00:00 nametype=DELETE 
type=PATH msg=audit(26/03/15 03:30:52.474:104290472) : item=1 name=/files/are/moved/to/ inode=6291457 dev=08:11 mode=dir,777 ouid=username ogid=username rdev=00:00 nametype=PARENT 
type=PATH msg=audit(26/03/15 03:30:52.474:104290472) : item=0 name=/web/directory/tmp/uploads/ inode=282198224 dev=08:11 mode=dir,755 ouid=username ogid=username rdev=00:00 nametype=PARENT 
type=CWD msg=audit(26/03/15 03:30:52.474:104290472) :  cwd=/web/directory 
type=SYSCALL msg=audit(26/03/15 03:30:52.474:104290472) : arch=x86_64 syscall=rename success=yes exit=0 a0=0x3377ba0 a1=0x33748a0 a2=0x3 a3=0x7f204a0c5f98 items=4 ppid=1069 pid=1102 auid=root uid=username gid=username euid=username suid=username fsuid=username egid=username sgid=username fsgid=username tty=(none) ses=694431 comm=php exe=/usr/bin/php key=tmp-folder 
----
type=PATH msg=audit(26/03/15 03:30:52.529:104290473) : item=4 name=/files/are/moved/to/1427355052-untitled-0.mp3 inode=282198224 dev=08:11 mode=dir,755 ouid=username ogid=username rdev=00:00 nametype=CREATE 
type=PATH msg=audit(26/03/15 03:30:52.529:104290473) : item=3 name=(null) inode=282198224 dev=08:11 mode=dir,755 ouid=username ogid=username rdev=00:00 nametype=DELETE 
type=PATH msg=audit(26/03/15 03:30:52.529:104290473) : item=2 name=(null) inode=239076972 dev=08:11 mode=dir,755 ouid=username ogid=username rdev=00:00 nametype=PARENT 
type=PATH msg=audit(26/03/15 03:30:52.529:104290473) : item=1 name=/files/are/moved/to/ inode=6291457 dev=08:11 mode=dir,777 ouid=username ogid=username rdev=00:00 nametype=PARENT 
type=PATH msg=audit(26/03/15 03:30:52.529:104290473) : item=0 name=/web/directory/tmp/ inode=239076972 dev=08:11 mode=dir,755 ouid=username ogid=username rdev=00:00 nametype=PARENT 
type=CWD msg=audit(26/03/15 03:30:52.529:104290473) :  cwd=/web/directory 
type=SYSCALL msg=audit(26/03/15 03:30:52.529:104290473) : arch=x86_64 syscall=rename success=yes exit=0 a0=0x335bd90 a1=0x335d2e8 a2=0x3 a3=0x7f204a0c5f98 items=5 ppid=1069 pid=1102 auid=root uid=username gid=username euid=username suid=username fsuid=username egid=username sgid=username fsgid=username tty=(none) ses=694431 comm=php exe=/usr/bin/php key=tmp-folder 
----
type=PATH msg=audit(26/03/15 03:32:01.540:104290526) : item=0 name=. inode=239076972 dev=08:11 mode=dir,755 ouid=username ogid=username rdev=00:00 nametype=NORMAL 
type=CWD msg=audit(26/03/15 03:32:01.540:104290526) :  cwd=/web/directory/tmp 
type=SYSCALL msg=audit(26/03/15 03:32:01.540:104290526) : arch=x86_64 syscall=open success=yes exit=3 a0=0x19b7930 a1=O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC a2=0x1 a3=0x7fffd2df7110 items=1 ppid=20744 pid=2023 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1 ses=960029 comm=ls exe=/bin/ls key=tmp-folder 
----
type=PATH msg=audit(26/03/15 03:32:01.541:104290527) : item=0 name=. inode=239076972 dev=08:11 mode=dir,755 ouid=username ogid=username rdev=00:00 nametype=NORMAL 
type=CWD msg=audit(26/03/15 03:32:01.541:104290527) :  cwd=/web/directory/tmp 
type=SYSCALL msg=audit(26/03/15 03:32:01.541:104290527) : arch=x86_64 syscall=lgetxattr success=no exit=-61(No data available) a0=0x7fffd2df6fc0 a1=0x7f538d7872fd a2=0x19bf990 a3=0xff items=1 ppid=20744 pid=2023 auid=root uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=pts1 ses=960029 comm=ls exe=/bin/ls key=tmp-folder 
----

If there's any other way I can monitor what's happening to this folder I would appreciate any suggestions.

  • What is your OS? – masegaloeh Mar 26 '15 at 8:59
  • @masegaloeh CentOS – Wasim Mar 26 '15 at 8:59
  • Is the folder getting deleted at regular intervals or is it sporadic? – GregL Mar 26 '15 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.