[CLUE-Tech] man -k stopped working

[Timothy C. Klein]

* Jed S. Baer (thag at frii.com) wrote:
> On Sun, 3 Nov 2002 23:27:08 -0700
> "Jed S. Baer" <thag at frii.com> wrote:
> 
> > On Sun, 3 Nov 2002 23:08:10 -0700
> > Jeffery Cann <fabian at jefferycann.com> wrote:
> > 
> > > I'm stumped ...
> > > 
> > > Can you post your /etc/man.config (default is /usr/etc/man.config)?
> > 
> > Sure. Funny thing here, I looked again at makewhatis, and noticed it
> > uses a "find {...} -newer /var/cache/man/whatis", I'm guessing when the
> > "-u" flag is specified. That would make sense. So I ran it as
> > "makewhatis -w", and all is OK. That leaves the question of what catted
> > /dev/null to that file. Can't reproduce the error now. But, something
> > created an empty/var/cache/man/whatis file, and since nothing changed
> > thereafter (WRT man pages), it just stayed empty. Probably never track
> > this down. ;-(
> 
> This has happened again. Any thoughts on how to pinpoint what process is
> truncating the /var/cache/man/whatis file? I guess I'll have to grep the
> sysinit scripts, but otherwise, how do I find out what's doing this?
> 

Well, just ask the NSA/CIA/FBI, they know everything that happens on
every computer, don't they? 

Sorry, bad joke.  You could write a little script to check the inode of
the file every minute, and email you if it changes, but that would only
give you a *time* that in changed, not the process that did it.  It
might help, though.  How would you intercept all write requests,
so that you log the write access first, and then pass it through?  I bet
that is possilbe, but I don't know if I could do it.

LSOF gives you a list of all the open files, with associated processes.
You could probalby write a script that pipes LSOF to a file, checks to
see if the file has been modified, if not, delete the LSOF file, if so,
email alert you and make sure the LSOF output is saved.

This might not be fine-grained enough to actaully catch the offended
process, though, as it may only take a fraction of a second to do the
write, in which case your script would have to be *really* tightly
looped to see it.  Hmm...

Tim
--
==============================================
== Timothy Klein || teece at silverklein.net   ==
== ---------------------------------------- ==
== "Hello, World" 17 Errors, 31 Warnings... ==
==============================================