Deleted folder keeps coming back

Question

I have a directory at /opt/splunk that I cannot seem to get rid of.

root@alpha:/opt# ls -la
total 87156
drwxr-xr-x  4 root root     4096 Feb 20 15:44 .
drwxr-xr-x 23 root root     4096 Feb 19 13:29 ..
drwxrwxrwx  3 root root     4096 Feb 20 15:23 data
drwx------  4 root root     4096 Feb 20 15:45 splunk
-rw-r--r--  1 root root 89224626 Dec 16 22:47 splunk-6.2.1-245427-linux-2.6-amd64.deb

I can remove it without an error which seems to work.

oot@alpha:/opt# rm -rf splunk
root@alpha:/opt# ls -la
total 87152
drwxr-xr-x  3 root root     4096 Feb 20 15:46 .
drwxr-xr-x 23 root root     4096 Feb 19 13:29 ..
drwxrwxrwx  3 root root     4096 Feb 20 15:23 data
-rw-r--r--  1 root root 89224626 Dec 16 22:47 splunk-6.2.1-245427-linux-2.6-amd64.deb

But then, I can still cd to it and it still contains the directories that it had before.

root@alpha:/opt# cd splunk
root@alpha:/opt/splunk# ls -la
total 12
drwx------ 3 root root 4096 Feb 20 15:46 .
drwxr-xr-x 4 root root 4096 Feb 20 15:46 ..
drwx------ 3 root root 4096 Feb 20 15:46 var

I can even delete the directory, create a file with the same name, delete the file, and still the old folder comes back!

root@alpha:/opt# ls -la
total 87156
drwxr-xr-x  4 root root     4096 Feb 20 15:46 .
drwxr-xr-x 23 root root     4096 Feb 19 13:29 ..
drwxrwxrwx  3 root root     4096 Feb 20 15:23 data
drwx------  4 root root     4096 Feb 20 15:48 splunk
-rw-r--r--  1 root root 89224626 Dec 16 22:47 splunk-6.2.1-245427-linux-2.6-amd64.deb
root@alpha:/opt# rm -rf splunk
root@alpha:/opt# touch splunk
root@alpha:/opt# ls -la
total 87152
drwxr-xr-x  3 root root     4096 Feb 20 15:48 .
drwxr-xr-x 23 root root     4096 Feb 19 13:29 ..
drwxrwxrwx  3 root root     4096 Feb 20 15:23 data
-rw-r--r--  1 root root        0 Feb 20 15:48 splunk
-rw-r--r--  1 root root 89224626 Dec 16 22:47 splunk-6.2.1-245427-linux-2.6-amd64.deb
root@alpha:/opt# rm splunk
root@alpha:/opt# ls -la
total 87152
drwxr-xr-x  3 root root     4096 Feb 20 15:48 .
drwxr-xr-x 23 root root     4096 Feb 19 13:29 ..
drwxrwxrwx  3 root root     4096 Feb 20 15:23 data
-rw-r--r--  1 root root 89224626 Dec 16 22:47 splunk-6.2.1-245427-linux-2.6-amd64.deb
root@alpha:/opt# cd splunk
root@alpha:/opt/splunk# ls -la
total 12
drwx------ 3 root root 4096 Feb 20 15:48 .
drwxr-xr-x 4 root root 4096 Feb 20 15:48 ..
drwx------ 3 root root 4096 Feb 20 15:48 var

I am going insane. Does anyone understand what is happening here? This is Debian.

root@alpha:/opt# cat /etc/debian_version
7.8

Responses to comments...

root@alpha:/opt/splunk# cd /opt/splunk ; df .
Filesystem                                             1K-blocks    Used Available Use% Mounted on
/dev/disk/by-uuid/830ee07d-3e7d-4d5e-a923-e998000f4a7c  10188088 1185164   8462356  13% /

Answer 1

According to modify dates you might have some process running which creates again files and dirs you just deleted.