RPM install/update creates files and then disappears?

[Bond Masuda]

Panu,

This is exactly the information I needed!! Thank you very much!

Bond

On 10/12/2015 05:44 AM, Panu Matilainen wrote:
> On 10/09/2015 01:54 PM, Bond Masuda wrote:
>> hello,
>>
>> i'm working on a file monitoring system and I'm noticing files like the
>> following example being created and then disappearing:
>>
>> /usr/share/zoneinfo/right/Europe/Zurich;56177f7a
>> /usr/share/zoneinfo/right/Europe/Bratislava;56177f7a
>> /usr/share/zoneinfo/right/Europe/Prague;56177f7a
>> /usr/share/zoneinfo/right/Europe/Belgrade;56177f7a
>> /usr/share/zoneinfo/right/Europe/Ljubljana;56177f7a
>> /usr/share/zoneinfo/right/Europe/Podgorica;56177f7a
>> /usr/share/zoneinfo/right/Europe/Sarajevo;56177f7a
>> /usr/share/zoneinfo/right/Europe/Skopje;56177f7a
>> /usr/share/zoneinfo/right/Europe/Zagreb;56177f7a
>> /usr/share/zoneinfo/right/Europe/Belfast;56177f7a
>> /usr/share/zoneinfo/right/Europe/Guernsey;56177f7a
>> /usr/share/zoneinfo/right/Europe/Isle_of_Man;56177f7a
>> /usr/share/zoneinfo/right/Europe/Jersey;56177f7a
>> /usr/share/zoneinfo/right/Europe/London;56177f7a
>> /usr/share/zoneinfo/right/GB;56177f7a
>> /usr/share/zoneinfo/right/GB-Eire;56177f7a
>> /usr/share/zoneinfo/right/Etc/UTC;56177f7a
>> /usr/share/zoneinfo/right/Etc/Universal;56177f7a
>> /usr/share/zoneinfo/right/Etc/Zulu;56177f7a
>> /usr/share/zoneinfo/right/UTC;56177f7a
>>
>> The sample above happened during a tzdata package update. Does rpm
>> create these files and then moves them to destination (over the old file
>> during an update)? Or, does it move the old file to files in the format
>> above and then deletes them when the new file install is completed?  If
>> so, how does it determine the "suffix" string, like ";56177f7a" in the
>> above samples? Is it randomly generated? What's the nature of this
>> suffix string? Is it always 8 characters wide? it seems to allow for
>> alphanumeric characters, but does that include capital letters? Are any
>> other characters allowed in the suffix string?
>
> The suffixed filenames are indeed temporaries used during unpacking 
> the rpm file, rename()'d to the final destination once unpacking 
> successfully completes.
>
> The suffix itself is rather arbitrary and you shouldn't rely too much 
> on it, but for the past decade plus some its been an eight character 
> lowercase hex string formed from "transaction id" which is just a 
> 32bit time(2) stamp at the beginning of that particular transaction. 
> For example in your particular case:
>
> [pmatilai at dhcp195 ~]$ python -c "import time; print 
> time.ctime(0x56177f7a)"
> Fri Oct  9 11:48:58 2015
>
> FWIW, the transaction id (tid) recorded during installs so if you know 
> a tid you can query which packages where installed during that 
> transaction, eg
>
> $ rpm -q --tid 0x56177f7a
>
>     - Panu -
>
>> If I can understand this better, I can write rules to categorize them as
>> being part of some RPM activity. Just need to understand what they are,
>> and what kind of patterns I can look for.
>>
>> Thanks,
>> Bond
>> _______________________________________________
>> Rpm-list mailing list
>> Rpm-list at lists.rpm.org
>> http://lists.rpm.org/mailman/listinfo/rpm-list
>
> _______________________________________________
> Rpm-list mailing list
> Rpm-list at lists.rpm.org
> http://lists.rpm.org/mailman/listinfo/rpm-list