I've got a server that is used as an SFTP endpoint and a script living somewhere else that periodically uploads to the server.

At a particular time every day all the files in the upload folder get the string 'archive_' prepended to their names.

How can I go about tracking down the culprit name changing script?

I've searched through the logs in /var/cron, looked at the scripts in /etc/cron*, looked at crontab -e on all the users with a home directory, done a grep of 'archive' /home, /etc/, and /usr and nothing useful has turned up.


Solved. The script that was pulling the files from the server was adding the text string to the file names to flag them as files that don't need to be pulled the next time around.

Thanks everyone!

|improve this answer|||||

With root access, sysdig or similar kernel tracing facilities can reveal what program is touching particular files:

# sysdig fd.name contains archive_

and then wait with that running though you may want additional restrictions on the path of those archive files, or to use the -p flag to select what attributes about the matching processes you are interested in.

|improve this answer|||||
  • Thanks! Having issues running sysdig because there's no precompiled sysdig-probe available for my kernel. Any chance there's an alternative program we can use? – d.dja Feb 25 '19 at 15:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.