[php-maint] Bug#668597: php5 creates weird files in /

[Bob Proulx]

Ulf Hermann wrote:
> ???  ???  bin   ?<??d?  data  etc   ?h?u??      ?L?ƥ?  lib64       media  opt
>   proc  sbin     srv  tmp     ???u??  usr  vmlinuz
> ?ʺ???   ?;??    boot  ??:?d?  dev   home  initrd.img  lib    lost+found  mnt
> P???  root  selinux  sys  ???u??  ???u??  var  ?w?ƥ?

What were the timestamps on those files that you found in / from this
event?  Were they current with a similar timestamp to the messages
you share below?  Or were they much older?  Could this have been
something that happened a long time ago?  Or is this something that
is continuing to happen daily?

> [11-Mar-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on line 0
> [25-Mar-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on line 0
> [01-Apr-2012 06:25:06] PHP Deprecated:  Comments starting with '#' are deprecated in /etc/php5/apache2/conf.d/apc.ini on line 1 in Unknown on line 0
> [...]

The timestamps above show that it has been happening not quite
weekly.  It looks like it skipped a week on the 18th.  But has
otherwise been happening on Sunday.  That could be a clue to find the
cron task that runs weekly on Sunday to find what has been happening.

Those init files are part of the php-apc package.  What is the status
of that package on your system?  Is it installed or removed?

  dpkg -l php-apc

> As only php is reading and interpreting /etc/php5/apache2/conf.d/apc.ini that makes me suspect a bug in PHP here.

I have two suspicions.  One is that an older version of the php-apc
package may have been installed at one time and then subsequently
removed but not purged leaving the conffiles in /etc around.  I
suspect that there may be something in those left behind files that
are interacting.  My second is that there is a cron task script that
we are not seeing that is perhaps a local script not from any package
that is causing this.

Could you look through the cron scripts that run weekly and try to
find what might be running at that time?

Bob