Could please someone explain those \0 hanging around my syslog…?
$ gunzip < /var/log/syslog.2.gz | hexdump -c
0076210 9 0 4 : 3 9 : 0 1 e l i o t
0076220 / U S R / S B I N / C R O N [
0076230 2 4 1 1 0 ] : ( r o o t ) C
0076240 M D ( [ - d / v a r /
0076250 l i b / p h p 5 ] & & f i
0076260 n d / v a r / l i b / p h p 5
0076270 / - t y p e f - c m i n
0076280 + $ ( / u s r / l i b / p h p 5
0076290 / m a x l i f e t i m e ) - p
00762a0 r i n t 0 | x a r g s - r
00762b0 - 0 r m ) \n \0 \0 \0 \0 \0 \0 \0 \0
00762c0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0
*
0076640 \0 \0 \0 \0 \0 \0 \0 \0 \0 \0 J u n 9
0076650 0 4 : 4 3 : 5 0 e l i o t
0076660 s y s l o g d 1 . 4 . 1 # 2 0
0076670 u b u n t u 4 : r e s t a r t
0076680 . \n J u n 9 0 4 : 4 3 : 5
0076690 0 e l i o t k e r n e l :
00766a0 I n s p e c t i n g / b o o t
00766b0 / S y s t e m . m a p - 2 . 6 .
00766c0 2 0 - 1 6 - 3 8 6 \n J u n 9
00766d0 0 4 : 4 3 : 5 1 e l i o t
00766e0 k e r n e l : L o a d e d 2
00766f0 4 5 0 1 s y m b o l s f r o
I suspect it’s been the previous php5 line:
Jun 9 04:39:01 eliot /USR/SBIN/CRON[24110]: (root) CMD ( [ -d /var/lib/php5 ] && find /var/lib/php5/ -type f -cmin +$(/usr/lib/php5/maxlifetime) -print0 | xargs -r -0 rm)
That “-print0″ and all the stuff is too suspectful… well, haven’t time to find now, I’ll hack my scripts to work around such situations by now!
