Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!linus!philabs!cmcl2!harvard!caip!lll-crg!lll-lcc!qantel!intelca!oliveb!glacier!hplabs!sdcrdcf!usc-oberon!smeagol!root
From: root@smeagol.UUCP (The Mysterons)
Newsgroups: net.news.adm,net.news.b,net.news.sa
Subject: Re: Need help with 2.10.3 expire
Message-ID: <713@smeagol.UUCP>
Date: Fri, 9-May-86 02:42:17 EDT
Article-I.D.: smeagol.713
Posted: Fri May  9 02:42:17 1986
Date-Received: Tue, 13-May-86 05:45:03 EDT
References: <750@rclex.UUCP>
Organization: JPL, Pasadena CA
Lines: 50
Keywords: expire
Xref: linus net.news.adm:655 net.news.b:1032 net.news.sa:287
Summary: We can check the bug with DEBUG

In article <750@rclex.UUCP>, walt@rclex.UUCP (Walter L. Weber) writes:
> After getting my system cleaned up I thought I would go through and expire
> the garbage articles, and FOOLISHLY did not back up the news directory before
> kicking off "expire -v7 -e0 -I -f Unknown@hplabs.UUCP >&RESULTS".
> 
> My questions are:
>       ...  I have either mis-understood the use of "-f somebody@where"
>       or there is a bug in expire.

That was the correct action to take; it is unfortunate that you got bitten.
I am not sure if it is a bug in expire, but here's some info:

	When the -f flag is given to expire, it sets a flag 'frflag' true.  It
also copies the username argument into a variable called 'badname'.  The 
frflag is referenced on one line via (line 377-379, expire.c in
2.10.3 4.3bsd-beta 6/6/85):

			     ((h.rectime+expincr > now) && !dorebuild && !frflag
				&& !usepost && h.recdate[0] != ' '))
				goto keephist;

The main reference is on line 542 (your mileage may vary; it shouldn't):

		if (frflag ? strcmp(baduser,h.from)==0 : now >= h.exptime) {
#ifdef DEBUG
			printf("cancel %s\n", filename);
#else /* !DEBUG */
			if (verbose)
				printf("cancel %s\n", filename);
			ulall(p2, &h);
			...

In order to find out if there is a bug, you can recompile expire with DEBUG
defined.  If you do this, ulall (UnLink ALL) will not be called, and your
news won't get nuked.  You *will* get the list of articles to be trashed, so
you can see if they really contain the hated "Unknown@hplabs" From: line.

I dunno, this test looks reasonable to me (the strcmp of the user name you
specified with -f, against the contents of the "From:" line), so I don't
know where it is coming from.  I *am* suspicious of lines with many '&&' in
them, tho ... :-)

My advice is: remake expire with DEBUG defined; run with your favorite
source level debugger, stopping at both 377 and 542 (don't specify rebuild
or whatever-sets-usepost etc.; test all values '&&'ed in line 377) and
see what is happening.  I will do this if I can get some time.

Hmm, I wonder if -e 0 has anything to do with this ... the plot sickens ...

The Mysterons