1

I'm running a web server that uses PHP5 and SQlite for database queries. I have my crontab set to reboot the machine at midnight each day.

Every few days, all of my files in the /var/www folder are gone along with the folder itself. Apache2 gives me a 404 error. When I restart Apache2, it fails because the /var/log/apache2 folder is deleted.

How can I stop this?

Elliot A.
  • 131
  • 5
  • Is there anything in your system logs? Try leaving a terminal running with the command "tail -f /var/logs/syslog" , and observe what shows up in the log when this happens. My guess is you have a mis-configured log rotation or something similar which is operating on your web-server route, one of the many log files in /var/logs should tell what was running and at what time, without knowing what was running when this happened, you have zero chance of figuring out what you need to stop. – shawty Apr 23 '17 at 12:51
  • I get the following error: tail: cannot open '/var/logs/syslog' for reading: No such file or directory – Elliot A. Apr 23 '17 at 12:54
  • @shawty That should have been /var/log/..., not /var/logs. I'm not sure how much help it will really be, but it is something you should get comfortable sifting through anyway so Elliot might as well start now. On Raspbian 8 (jessie) there is also the similar journalctl -x (see man journalctl). – goldilocks Apr 23 '17 at 14:05
  • The -x isn't terribly useful with journalctl, but otherwise it's generally a better program to use than grovelling in log files on Debian 8 because, unless you ask it otherwise, it displays all log entries. Just remember, you need to be root when you run it to see all log entries. – cjs Apr 23 '17 at 15:41
  • @ElliotA. Yes your correct, slip of the finger by the looks of it, fat fingers, small keyboard :-) – shawty Apr 23 '17 at 17:53
  • 1
    For diagnosis, adding to what shawty said, you could write yourself a script that checks the existence of /var/www every minute and writes a message to your own log when it no longer exists. That way you would at least know when it happens (time stamp on file). I'm not expert enough to sit here and quote the code but I googled this quickly: if [ ! -d "$DIRECTORY" ]; then

    Control will enter here if $DIRECTORY doesn't exist.

    fi Also, maybe a permissions/owner change to stop it being deleted but I wouldn't change anything until I figure out what's going on.

     – MartinMarty Apr 23 '17 at 19:55
  • 1
    Another angle: Is your web server reachable from the public Internet? Does any part of your PHP code delete files? Can a web crawler delete files simply by following all of the hyperlinks on your website? (This has happened to people before.) – Hydraxan14 Apr 24 '17 at 17:52
  • Also, I assume you're using the Raspbian Linux distribution on your Pi? – Hydraxan14 Apr 24 '17 at 17:54
  • @Hydraxan14 yes, i am – Elliot A. Apr 24 '17 at 22:22
  • @Hydraxan14 Also, it is on the public internet, but no part of the script deletes files – Elliot A. Apr 24 '17 at 22:22
  • This reminds me of the old days where we had to always remember to do sync;sync;sync before ever allowing our systems to shut down. And always keep them on a UPS just to make sure. Back then, unexpected reboots would corrupt the file structure. But if the cron job used the bona fide reboot command (or init 6) then even the old boxes would have been fine. – SDsolar Apr 25 '17 at 02:22
  • As for the public internet causing this it dosnt make sense that it would be periodic. I can see some kid out there hacking your script once or constantly, but periodic sounds systemic. – SDsolar Apr 25 '17 at 02:28
  • I was wondering about logrotate and cron scripts, so I ran the following command:

    sudo grep -rnH '/var/www' /etc

    I was surprised to see that /var/www is the home directory for userid www-data. Is there any chance that userid is being deleted or recreated about the time the files go away?

     – Chad Farmer May 02 '17 at 05:24

0 Answers0