Path: utzoo!mnetor!uunet!lll-winken!lll-lcc!ames!ll-xn!mit-eddie!minya!jc
From: jc@minya.UUCP (John Chambers)
Newsgroups: news.software.b
Subject: Another rash of empty files with long names...
Message-ID: <483@minya.UUCP>
Date: 19 Mar 88 13:51:27 GMT
Organization: home
Lines: 45

Well, it happened again, and I'm getting rather curious.  The .rnews
directory here got very large, and was filled with a horde of empty
files.  For assorted reasons, I'd doctored the news source so that
every call of system() was surrounded by output to stderr, which I
directed to an audit file.  The following was in it:

Command: "/usr/bin/rnews -S -p 5153"
Status=0.
Command: "/usr/bin/rnews -S -p 88031812151497"
Status=0.
Command: "/usr/bin/rnews -S -p 88031812151499"
Status=0.
Command: "/usr/bin/rnews -S -p 8803181215149b"
Status=0.
Command: "/usr/bin/rnews -S -p 8803181215149d"
Status=0.
Command: "/usr/bin/rnews -S -p 8803181215149f"
Status=0.
Command: "/usr/bin/rnews -S -p 880318121514a1"
Status=0.
Command: "/usr/bin/rnews -S -p 880318121514a3"
Status=0.
Command: "/usr/bin/rnews -S -p 880318121514a5"
Status=0.
Command: "/usr/bin/rnews -S -p 880318121514a7"

and so on for (according to wc) about 32000 lines, at which point everything
hung because the news partion was out of blocks.  Well, it may not have been.
I unmounted it and ran fsck, and 11014 blocks re-appeared.  

Anyhow, the above file names are a bit peculiar, and I've seen them before
They obviously consist of a timestamp (this happened on March 18), plus some
sort of sequence number that goes up by two.  I've looked at all the calls
of open() and fopen() in the news source, and none of them look like they
create such file names, but I'm obviously missing something.  

I've been considering putting in a hack to intercept all the opens, check 
for this sort of name, and put out warnings.  Meanwhile, I thought I'd
ask if anyone out there has any idea why these files get created.  They
always seem to be empty, and they don't always stay around long (though
this time they did).  

Anyone know what might be going on?

-- 
John Chambers <{adelie,ima,maynard,mit-eddie}!minya!{jc,root}> (617/484-6393)