nul files appearing

[stubing]

I am working on a system that uses Red Hat Client 5.3. FIles keep being created all over the system. They are all named nul and are zero length. We use a common login and thy are owned by this login account. I have grep'd the entire system looking for some code that would be writing these files but nothing has come up. Any ideas?

[Irithori]

First of all: Common login = bad
As you now experience, you can not ask one specific user, wth (s)he is doing, instead it is somewhat cloudy.

Some steps:
- Issue "history" as that user
- Issue "last" to get an idea if the login times somehow corelate with the creation time of these files.
- "crontab -u <COMMONUSER> -l" to check for possible cronjobs
- also search the system crontab and hourly/daily/etc while you are at it
- It is also possible, that some sftp / ftp / <whatever_you_offer> client connected with these credentials. Check the logs.
- Do any daemons run with that uid?

[Rubberman]

You can use the inotify subsystem to watch for file creation and use that information to find out what application is creating those nul files.