Thank you, David, Judah Richardson, and Richard Hector, for your suggestions; unfortunately, the appearance of the history.db files remains a mystery.
> Do you have some kind of backup, sync, or versioning application
> running?
I have a daily cron job that runs rsync to copy my home directory to a
backup disk. That's been running for several years without any changes.
I periodically run rsync manually as well.
> Are they open by some process? Check with lsof.
The commands "lsof | grep history" and "sudo lsof | grep 'history.db'"
return nothing.
> Any clues from what directories they appear in? Are they in home
> directories? /etc tree? /var tree?
Nothing in /etc or /var; most are in my home directory (and now also the
backup disk to which it's been rsynced), mostly in directories where
I've edited text files, although there is also one in a Videos directory
on a different mounted drive. There is also one in /tmp. Not counting
the backups, there are 13 of these files, appearing at a handful of
times between Jul 22 and Aug 8. (The upgrade from Debian 9 to Debian 10
occurred on Jul 17.)
> If you're familiar with sqlite (or even sql, and can google the
> specifics), you could dig around inside and see if you can get any
> clues that way.
I'm not, but what I see is this:
$sqlite3 history/history.db
sqlite> .dump
PRAGMA foreign_keys=OFF;
BEGIN TRANSACTION;
CREATE TABLE version (
version VARCHAR NOT NULL,
datfile VARCHAR UNIQUE NOT NULL);
COMMIT;
(The Web browser midori keeps a history.db file in a subdirectory
of ~/.config, but its existence, size, and content are as expected;
I don't think that has anything to do with my mystery files.)
> On a computer running Debian 10, in a number of directories a
> subdirectory "history" has mysteriously appeared containing a
> file history.db. There are 11 of these history.db files in various
> places in my home directory; cmp reveals that they are all identical.
> Each is an "SQLite 3.x database, last written using SQLite version
> 3027002." Each is a 12288-byte file containing, in addition to a
> bunch of special characters, the words: "tableversionversionCREATE
> TABLE version ( version VARCHAR NOT NULL, datfile VARCHAR UNIQUE
> NOT NULL)-Andexsqlite_autoindex_version_1version." In some (but not
> all) cases the timestamp on history/history.db matches the timestamp
> of some file I was editing with vim 8.1.1401 in the same directory
> containing the history subdirectory--for whatever that's worth--but
> I can't reproduce the phenomenon by editing similar files with vim.
> All history/history.db files appeared since upgrading from Debian 9.
> I couldn't find anything relevant in the log files around the
> timestamps of the mystery files.
Regards,
Greg Marks
signature.asc
Description: PGP signature
