RPM install/update creates files and then disappears?

[Panu Matilainen]

On 10/09/2015 01:54 PM, Bond Masuda wrote:
> hello,
>
> i'm working on a file monitoring system and I'm noticing files like the
> following example being created and then disappearing:
>
> /usr/share/zoneinfo/right/Europe/Zurich;56177f7a
> /usr/share/zoneinfo/right/Europe/Bratislava;56177f7a
> /usr/share/zoneinfo/right/Europe/Prague;56177f7a
> /usr/share/zoneinfo/right/Europe/Belgrade;56177f7a
> /usr/share/zoneinfo/right/Europe/Ljubljana;56177f7a
> /usr/share/zoneinfo/right/Europe/Podgorica;56177f7a
> /usr/share/zoneinfo/right/Europe/Sarajevo;56177f7a
> /usr/share/zoneinfo/right/Europe/Skopje;56177f7a
> /usr/share/zoneinfo/right/Europe/Zagreb;56177f7a
> /usr/share/zoneinfo/right/Europe/Belfast;56177f7a
> /usr/share/zoneinfo/right/Europe/Guernsey;56177f7a
> /usr/share/zoneinfo/right/Europe/Isle_of_Man;56177f7a
> /usr/share/zoneinfo/right/Europe/Jersey;56177f7a
> /usr/share/zoneinfo/right/Europe/London;56177f7a
> /usr/share/zoneinfo/right/GB;56177f7a
> /usr/share/zoneinfo/right/GB-Eire;56177f7a
> /usr/share/zoneinfo/right/Etc/UTC;56177f7a
> /usr/share/zoneinfo/right/Etc/Universal;56177f7a
> /usr/share/zoneinfo/right/Etc/Zulu;56177f7a
> /usr/share/zoneinfo/right/UTC;56177f7a
>
> The sample above happened during a tzdata package update. Does rpm
> create these files and then moves them to destination (over the old file
> during an update)? Or, does it move the old file to files in the format
> above and then deletes them when the new file install is completed?  If
> so, how does it determine the "suffix" string, like ";56177f7a" in the
> above samples? Is it randomly generated? What's the nature of this
> suffix string? Is it always 8 characters wide? it seems to allow for
> alphanumeric characters, but does that include capital letters? Are any
> other characters allowed in the suffix string?

The suffixed filenames are indeed temporaries used during unpacking the 
rpm file, rename()'d to the final destination once unpacking 
successfully completes.

The suffix itself is rather arbitrary and you shouldn't rely too much on 
it, but for the past decade plus some its been an eight character 
lowercase hex string formed from "transaction id" which is just a 32bit 
time(2) stamp at the beginning of that particular transaction. For 
example in your particular case:

[pmatilai at dhcp195 ~]$ python -c "import time; print time.ctime(0x56177f7a)"
Fri Oct  9 11:48:58 2015

FWIW, the transaction id (tid) recorded during installs so if you know a 
tid you can query which packages where installed during that transaction, eg

$ rpm -q --tid 0x56177f7a

	- Panu -

> If I can understand this better, I can write rules to categorize them as
> being part of some RPM activity. Just need to understand what they are,
> and what kind of patterns I can look for.
>
> Thanks,
> Bond
> _______________________________________________
> Rpm-list mailing list
> Rpm-list at lists.rpm.org
> http://lists.rpm.org/mailman/listinfo/rpm-list