8:12 a.m.
Hello
Something keeps creating a file, Events.json, in my home directory. It
only ever contains an empty JSON array, but if I remove the file,
something just creates it again. Has anyone seen this before? What
program could be behind this? This only started happening after I
installed Fedora 37 Workstation, and never happened to me before on
Fedora 36.
--
Terveisin / Regards,
Matti Pulkkinen
4:26 p.m.
On 20 Nov 2022, at 14:13, Matti Pulkkinen <mkjpul(a)utu.fi>
wrote:
Hello
Something keeps creating a file, Events.json, in my home directory. It
only ever contains an empty JSON array, but if I remove the file,
something just creates it again. Has anyone seen this before? What
program could be behind this? This only started happening after I
installed Fedora 37 Workstation, and never happened to me before on
Fedora 36.
Faced with this surprise i would start by having a look at the contents of the
file
for clues as to the type of program that might write it.
What do you see in the file?
Barry
--
Terveisin / Regards,
Matti Pulkkinen
_______________________________________________
users mailing list -- users(a)lists.fedoraproject.org
To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/users@lists.fedoraproject.org
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
3:54 p.m.
On Sun, 2022-11-20 at 22:26 +0000, Barry wrote:
Faced with this surprise i would start by having a look at the
contents of the file
for clues as to the type of program that might write it.
What do you see in the file?
Barry
I mentioned it earlier, but the only thing in the file is an empty
array, []. However, after installing updates last night and deleting
the file once more today, the file is now (hopefully) permanently gone.
I still don't know what created it but I suppose it doesn't matter now.
--
Terveisin / Regards,
Matti Pulkkinen
10:17 p.m.
On Sun, Nov 20, 2022 at 7:12 AM Matti Pulkkinen <mkjpul(a)utu.fi> wrote:
Something keeps creating a file, Events.json, in my home directory.
It
only ever contains an empty JSON array, but if I remove the file,
something just creates it again. Has anyone seen this before? What
program could be behind this? This only started happening after I
installed Fedora 37 Workstation, and never happened to me before on
Fedora 36.
If you can't figure this out otherwise, here's a heavyweight solution.
Install the systemtap package. Run "sudo stap-prep". Put this in a
file named, say, events.stp, and replace "<username>" with your actual
username:
```
probe vfs.open
{
if (pathname == "/home/<username>/events.json")
printf("events.json created by %s (pid %d, uid %d)\n", execname(),
pid(), uid())
}
```
That's crude, because it doesn't check that the file is opened in
create mode, but it will do for your case. Delete events.json, then
run "sudo stap events.stp". Come back later and see if it has printed
anything. If I run "touch events.json" in another shell, for example,
it prints:
events.json created by touch (pid 39957, uid 1000)
Press Ctrl-C to exit from stap when you are done.
--
Jerry James
http://www.jamezone.org/
1:47 a.m.
On 11/20/22 20:17, Jerry James wrote:
On Sun, Nov 20, 2022 at 7:12 AM Matti Pulkkinen <mkjpul(a)utu.fi>
wrote:
> Something keeps creating a file, Events.json, in my home directory. It
> only ever contains an empty JSON array, but if I remove the file,
> something just creates it again. Has anyone seen this before? What
> program could be behind this? This only started happening after I
> installed Fedora 37 Workstation, and never happened to me before on
> Fedora 36.
If you can't figure this out otherwise, here's a heavyweight solution.
Install the systemtap package. Run "sudo stap-prep". Put this in a
file named, say, events.stp, and replace "<username>" with your actual
username:
```
probe vfs.open
{
if (pathname == "/home/<username>/events.json")
printf("events.json created by %s (pid %d, uid %d)\n", execname(),
pid(), uid())
}
```
That's crude, because it doesn't check that the file is opened in
create mode, but it will do for your case. Delete events.json, then
run "sudo stap events.stp". Come back later and see if it has printed
anything. If I run "touch events.json" in another shell, for example,
it prints:
events.json created by touch (pid 39957, uid 1000)
Press Ctrl-C to exit from stap when you are done.
Jerry:
Can you give a bit more info on this. Where does "events.stp" need to
live and is the material in your ''' all that needs to be in the file
(the use of ''' implies there is something else either before and/or after
Thanks
Paul
9:43 a.m.
On Sun, 20 Nov 2022 23:47:19 -0800
Paul Allen Newell <pnewell0705(a)gmail.com> wrote:
On 11/20/22 20:17, Jerry James wrote:
> If you can't figure this out otherwise, here's a heavyweight
> solution. Install the systemtap package. Run "sudo stap-prep".
> Put this in a file named, say, events.stp, and replace "<username>"
> with your actual username:
>
> ```
> probe vfs.open
> {
> if (pathname == "/home/<username>/events.json")
> printf("events.json created by %s (pid %d, uid %d)\n",
> execname(), pid(), uid())
> }
> ```
>
> That's crude, because it doesn't check that the file is opened in
> create mode, but it will do for your case. Delete events.json, then
> run "sudo stap events.stp". Come back later and see if it has
> printed anything. If I run "touch events.json" in another shell,
> for example, it prints:
>
> events.json created by touch (pid 39957, uid 1000)
>
> Press Ctrl-C to exit from stap when you are done.
Jerry:
Can you give a bit more info on this. Where does "events.stp" need to
live and is the material in your ''' all that needs to be in the file
(the use of ''' implies there is something else either before and/or
after
This is from the stap man page:
The stap program is the front-end to the Systemtap tool. It accepts
probing instructions written in a simple domain-specific language,
translates those instructions into C code, compiles this C code, and
loads the resulting module into a running Linux kernel or a Dyninst
user-space mutator, to perform the requested system trace/probe
functions. You can supply the script in a named file (FILENAME),
from standard input (use - instead of FILENAME), or from the command
line (using -e SCRIPT). The program runs until it is interrupted by
the user, or if the script voluntarily invokes the exit() function, or
by sufficient number of soft errors.
This is just a snippet of code that stap will implement when you run it
on the file. I think the three ... are just markers to indicate the
code. As to where it should go, a file in your home directory is fine.
You would have to run the sudo stap events.stp in the directory where
it resides, or use a path to the executable. Or maybe
sudo stap -e events.stp
from what I can see in the manual.
Caveat: I haven't used stap, just got this from the extensive man page.
10:53 a.m.
On Mon, Nov 21, 2022 at 8:43 AM stan via users
<users(a)lists.fedoraproject.org> wrote:
This is just a snippet of code that stap will implement when you run
it
on the file. I think the three ... are just markers to indicate the
code. As to where it should go, a file in your home directory is fine.
You would have to run the sudo stap events.stp in the directory where
it resides, or use a path to the executable. Or maybe
sudo stap -e events.stp
from what I can see in the manual.
Yes, that's all exactly right. The three backticks are how python
marks blocks of text. I've gotten into the habit of using those in
emails to separate code from commentary. Sorry if that was confusing.
So, yes, create events.stp anywhere, and pass the path to stap if it
isn't in the current directory.
--
Jerry James
http://www.jamezone.org/
10:26 a.m.
On Mon, 21 Nov 2022 09:53:39 -0700
Jerry James <loganjerry(a)gmail.com> wrote:
Yes, that's all exactly right. The three backticks are how
python
marks blocks of text. I've gotten into the habit of using those in
emails to separate code from commentary. Sorry if that was confusing.
Thanks for this explanation. I was unaware of this functionality, and
it looks interesting.
3:57 p.m.
On Sun, 2022-11-20 at 21:17 -0700, Jerry James wrote:
If you can't figure this out otherwise, here's a heavyweight
solution.
Install the systemtap package. Run "sudo stap-prep". Put this in a
file named, say, events.stp, and replace "<username>" with your
actual
username:
```
probe vfs.open
{
if (pathname == "/home/<username>/events.json")
printf("events.json created by %s (pid %d, uid %d)\n",
execname(),
pid(), uid())
}
```
That's crude, because it doesn't check that the file is opened in
create mode, but it will do for your case. Delete events.json, then
run "sudo stap events.stp". Come back later and see if it has
printed
anything. If I run "touch events.json" in another shell, for
example,
it prints:
events.json created by touch (pid 39957, uid 1000)
Press Ctrl-C to exit from stap when you are done.
--
Jerry James
http://www.jamezone.org/
That's very neat. The file is gone now, thankfully, but I'll have to
remember this tip for the future. Thanks!
--
Terveisin / Regards,
Matti Pulkkinen
10:41 p.m.
On Sun, Nov 20, 2022 at 9:12 AM Matti Pulkkinen <mkjpul(a)utu.fi> wrote:
Something keeps creating a file, Events.json, in my home directory. It
only ever contains an empty JSON array, but if I remove the file,
something just creates it again. Has anyone seen this before? What
program could be behind this? This only started happening after I
installed Fedora 37 Workstation, and never happened to me before on
Fedora 36.
One program that creates an events.json is zoneminder. zoneminder is a
security camera program. I'm not sure if it's the same events.json,
however.
The next time it is created, chown the file to root:root, then chmod
o-rwx. Then see if a program crashes trying to access it.
Jeff
532
days inactive
534
days old
9 comments
6 participants
participants (6)
-
Barry -
Jeffrey Walton -
Jerry James -
Matti Pulkkinen -
Paul Allen Newell -
stan