Message-ID: <6b344a9d0ae654ca0bda0381a2f7f96df76ae3b2.camel@cybertec.at>
Subject: Re: Unknown temp directories and library files
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Priancka Chatz <pc9926@gmail.com>, pgsql-admin
 <pgsql-admin@postgresql.org>
Date: Fri, 11 Oct 2024 15:09:34 +0200
In-Reply-To: 
 <CANnOdgb=p9mLcg=5BMJ76yEZ+RYR7WHgS1VJRf8EY5VvOcf3ng@mail.gmail.com>
References: 
	<CANnOdgb=p9mLcg=5BMJ76yEZ+RYR7WHgS1VJRf8EY5VvOcf3ng@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.52.4 (3.52.4-1.fc40) 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/6b344a9d0ae654ca0bda0381a2f7f96df76ae3b2.camel%40cybertec.at>
Precedence: bulk

On Thu, 2024-10-10 at 12:22 +0200, Priancka Chatz wrote:
> I am observing a new/unknown behavior on some of my instances. My postgre=
s Data
> directory path is /home/postgres/pgdata/pgroot/data. And I see a temp dir=
ectory
> present inside /home/postgres/pgdata which has 100s of directory undernea=
th it
> and inside each directory some library files related to Psycopg2. Not sur=
e what
> these files are and why it is getting created. I am attaching screenshots=
 for reference.
> Can anyone shed some light or direct me to any links to troubleshoot this=
?

I'd say somebody broke into your database and is abusing it for his purpose=
s.

If that proves true, rescue what you can of the data and start with a new
installation, preferably with better security.

Yours,
Laurenz Albe