Subject: Strange /proc stuff

From: Bret Sanders <[email-masked]>
Date: Thu, 5 Nov 1998 12:04:55 -0800 (PST)

I'm running wu-ftpd b18-V10 under Solaris SPARC 2.6. Every couple days, my
root file system fills up ever since I upgraded from 2.4. Part of this is
due to my wtmpx and wtmp being configured correctly now, logging every ftp
login. But today, I noticed this in /proc, for one of the wu-ftpd
processes:

classic# find / -size +10000 -exec ls -l {} \;
<SNIP>
--w-------   0 root     bin      210618216 Nov  5 11:43 /proc/7326/fd/6
--w-------   0 root     other    20386980 Nov  5 11:43 /proc/7326/fd/7
<SNIP>

I dont know the details of what is held in /proc/#/fd, but I have a
feeling it shouldn't grow this big.

My root partition immediately went from 100% to 18% full after killing
process 7326 and removing /proc/7326.

Bret

---

From: Gregory A Lundberg <[email-masked]>
Date: Thu, 5 Nov 1998 15:45:19 -0500 (EST)

On Thu, 5 Nov 1998, Bret Sanders wrote:

> I'm running wu-ftpd b18-V10 under Solaris SPARC 2.6. Every couple
> days, my root file system fills up ever since I upgraded from 2.4.
> Part of this is due to my wtmpx and wtmp being configured correctly
> now, logging every ftp login. But today, I noticed this in /proc, for
> one of the wu-ftpd processes:

VR10 has an option to disable wtmp logging if you're not interested in
seeing every time user 'ftp' logs in to the system.  this can help control
the growth of the wtmp file(s).

> feeling it shouldn't grow this big.

It would be good to know exactly what was assigned file handle #6 and 7 in
process 7326.  Some Unix systems have commands which can show that.

On my system, file handle 6 is used during communications (for instance,
it is the data socket for a PASV connection).  What it's used for is
pretty fluid, but I'd guess it's something to do with an ongoing file
transmission.

What you might do is look for missing special devices or incorrectly
defined special devices.  If you're really paranoid, you could ask
yourself why anyone would be doing a 210M-byte transmission .. since it's
close to a DoS, you need to ask if it was intentional.

You could also try using beta-18 (from before the VR patches) and let me
know if the problem goes away.

-- 

Gregory A Lundberg		Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195