Tag Archives: files and filesystems

Files and Filesystems: Remove Files With Strange Filenames

If it is a file that is called ‘ ‘, i.e. a single space, you can delete it a couple of ways:

$ touch \ 
$ ls -la
total 4
-rw-rw-r--   1 foo    bar            0 Nov 24 11:26
drwxrwxr-x   2 foo    bar          512 Nov 24 11:26 .
drwxr-xr-x  10 foo    bar         1024 Nov 24 11:25 ..
$ rm ' '
$ ls -la
total 4
drwxrwxr-x   2 foo    bar          512 Nov 24 11:26 .
drwxr-xr-x  10 foo    bar         1024 Nov 24 11:25 ..
$ touch \ 
$ ls -la
total 4
-rw-rw-r--   1 foo    bar            0 Nov 24 11:26
drwxrwxr-x   2 foo    bar          512 Nov 24 11:26 .
drwxr-xr-x  10 foo    bar         1024 Nov 24 11:25 ..
$ ls -lia
total 4
       320 -rw-rw-r--   1 foo    bar            0 Nov 24 11:26
       319 drwxrwxr-x   2 foo    bar          512 Nov 24 11:26 .
         6 drwxr-xr-x  10 foo    bar         1024 Nov 24 11:25 ..
$ find . -inum 320 -exec rm {} \;
$ ls -la
total 4
drwxrwxr-x   2 foo   bar          512 Nov 24 11:26 .
drwxr-xr-x  10 foo   bar         1024 Nov 24 11:25 ..

$ touch \

$ ls -la

total 4

-rw-rw-r-- 1 foo bar 0 Nov 24 11:26

drwxrwxr-x 2 foo bar 512 Nov 24 11:26 .

drwxr-xr-x 10 foo bar 1024 Nov 24 11:25 ..

$ rm ' '

$ ls -la

total 4

drwxrwxr-x 2 foo bar 512 Nov 24 11:26 .

drwxr-xr-x 10 foo bar 1024 Nov 24 11:25 ..

$ touch \

$ ls -la

total 4

-rw-rw-r-- 1 foo bar 0 Nov 24 11:26

drwxrwxr-x 2 foo bar 512 Nov 24 11:26 .

drwxr-xr-x 10 foo bar 1024 Nov 24 11:25 ..

$ ls -lia

total 4

320 -rw-rw-r-- 1 foo bar 0 Nov 24 11:26

319 drwxrwxr-x 2 foo bar 512 Nov 24 11:26 .

6 drwxr-xr-x 10 foo bar 1024 Nov 24 11:25 ..

$ find . -inum 320 -exec rm {} \;

$ ls -la

total 4

drwxrwxr-x 2 foo bar 512 Nov 24 11:26 .

drwxr-xr-x 10 foo bar 1024 Nov 24 11:25 ..

Also, it might actually be some kind of control character … observe:

$ touch ^G   (CTRL-V CTRL-G)
$ ls -la
total 4
-rw-rw-r--   1 foo    bar            0 Nov 24 11:27
drwxrwxr-x   2 foo    bar          512 Nov 24 11:27 .
drwxr-xr-x  10 foo    bar         1024 Nov 24 11:25 ..
$ ls -lba
total 4
-rw-rw-r--   1 foo    bar            0 Nov 24 11:27 \007
drwxrwxr-x   2 foo    bar          512 Nov 24 11:27 .
drwxr-xr-x  10 foo    bar         1024 Nov 24 11:25 ..

$ touch ^G (CTRL-V CTRL-G)

$ ls -la

total 4

-rw-rw-r-- 1 foo bar 0 Nov 24 11:27

drwxrwxr-x 2 foo bar 512 Nov 24 11:27 .

drwxr-xr-x 10 foo bar 1024 Nov 24 11:25 ..

$ ls -lba

total 4

-rw-rw-r-- 1 foo bar 0 Nov 24 11:27 \007

drwxrwxr-x 2 foo bar 512 Nov 24 11:27 .

drwxr-xr-x 10 foo bar 1024 Nov 24 11:25 ..

Easy to remove with the same find . -inum technique above.

If the file starts with a - character, e.g.:

$ ls -l
-rw-rw-rw--  1 foo   bar             0 Nov 24 11:27 -foo

1 2	$ ls -l -rw-rw-rw-- 1 foo bar 0 Nov 24 11:27 -foo

try removing it:

$ rm -foo

$ rm -foo

Obviously it’ll whinge about -foo not being an option … so:

$ rm -- -foo

1	$ rm -- -foo

That’ll do it. -- tells the command to stop interpreting arguments as options. You can use this technique with other commands too, e.g. mv, file, etc.

Files and Filesystems: Core Files

Note: This tip assumes that you’ve checked the filesystem for legitimate files called core before running the scripts/commands contained herein! See the bottom of this article for how to do that.

Coredumps are created when a program crashes and dumps the contents of memory at the time of the crash to disk. Left unchecked, coredumps can quickly become a problem, consuming vast amounts of disk space.

You can find and remove core dumps with a command such as:

find / -name "core" -exec rm {} \;

1	find / -name "core" -exec rm {} \;

This is fine for a quick fix, but for a longer-lasting solution you can do one of two things. If your OS/Shell support it, you can add the following line to /etc/profile for POSIX compliant shells to disable core dump generation:

ulimit -c 0 2>/dev/null

1	ulimit -c 0 2>/dev/null

(For the C shell, add the line “limit coredumpsize 0” to /etc/csh.login).

If your OS/Shell doesn’t support this, you can still tackle the problem as it happens. Most core files appear in users home directories. Running a quick script such as:

#!/bin/sh
find / -name "core" -print > corelist
while read corefile
do
  cat /dev/null > $corefile
  chmod 444 $corefile
done < corelist
exit 0

#!/bin/sh

find / -name "core" -print > corelist

while read corefile

cat /dev/null > $corefile

chmod 444 $corefile

done < corelist

exit 0

will ensure that any core file on the system is truncated to zero bytes and marked read-only, so that the core file cannot be re-created and thus will never be larger than 0 bytes. Obviously, this is a very kludgy solution, and to work efficiently, you’d need a zero byte core file in everyone’s home directory (and anywhere else on the system coredumps are found), but suffices on very old systems where ulimit isn’t available. Run from cron on a nightly basis, this can be a very useful technique on old systems.

A much more robust way of searching for and deleting core dumps is with a command like:

find . -name "core" -type f -exec file {} \; |\
 awk 'BEGIN { FS = ":" } $2 ~ /core file/ { print $1 }' | xargs rm -f

1 2	find . -name "core" -type f -exec file {} \; \|\ awk 'BEGIN { FS = ":" } $2 ~ /core file/ { print $1 }' \| xargs rm -f

If you want to be cautious, then change the rm -f to rm -i.

If you’re using a system other than Solaris, you may need to modify the regex in the awk command to match whatever the output of the file command gives you when executed against a core dump.

We can see this in action here…

$ sleep 100 &
[3] 3244
$ kill -11 %3
$
[3] + Segmentation Fault
$ ls
core
$ mkdir tmp
$ touch tmp/core
$ file tmp/core
tmp/foo: empty
$ find . -name "core" -type f -exec file {} \; |\
> awk 'BEGIN { FS = ":" } $2 ~ /core file/ { print $1 }' | xargs rm -f
$ ls
$ ls tmp
core

$ sleep 100 &

[3] 3244

$ kill -11 %3

[3] + Segmentation Fault

$ ls

core

$ mkdir tmp

$ touch tmp/core

$ file tmp/core

tmp/foo: empty

$ find . -name "core" -type f -exec file {} \; |\

> awk 'BEGIN { FS = ":" } $2 ~ /core file/ { print $1 }' | xargs rm -f

$ ls

$ ls tmp

core

As you can see, it’s only removed the true core dump.

Files and Filesystems: How to Mount ISO Images

Most modern Linux kernels support the loop mount option. One of the nifty things about the loop filesystem option is that it allows you to mount an ISO image directly into the filesystem without having to burn the image onto a CD first. You could simply run the command

mount -o loop foo.iso /mnt

1	mount -o loop foo.iso /mnt

to mount foo.iso on the /mnt mountpoint. The type should be auto-detected (iso9660). If things don’t auto-detect, explicitly state them by running a command something along the lines of:

mount -t iso9660 -o ro,loop foo.iso /mnt/cdrom

1	mount -t iso9660 -o ro,loop foo.iso /mnt/cdrom

Files and Filesystems: Determining the End of Line Character for a File

You would like to find out which end of line characters are used in a file. Run a command similar to the following:

head -1 myfile | od -ta

1	head -1 myfile \| od -ta

For a DOS file, you get:

0000000   m   y   l   i   n   e   cr  nl

1	0000000 m y l i n e cr nl

For a UNIX file, you get:

0000000   m   y   l   i   n   e   nl

1	0000000 m y l i n e nl

Where cr is a carriage return (\r), and nl is a newline (\n).

Alternatively,

head -1 myfile | od -c

1	head -1 myfile \| od -c

gives the slightly more logical output of

0000000   m   y   l   i   n   e   \r  \n

1	0000000 m y l i n e \r \n

for a DOS file, or

0000000   m   y   l   i   n   e   \n

1	0000000 m y l i n e \n

for a UNIX file.

Mac files terminate with \r only.

Toki Winter

Advanced UNIX for the experienced system administrator

Tag Archives: files and filesystems

Files and Filesystems: Remove Files With Strange Filenames

Files and Filesystems: Core Files

Files and Filesystems: How to Mount ISO Images

Files and Filesystems: Determining the End of Line Character for a File