ls is being killed

UNIX for Advanced & Expert Users
1

Hi There,

Hope anyone can give me a hand on AIX

oslevel -r
5300-05

Try to "ls *sh" from folder and it return killed, is there any clue on that?

  1. perform ls and count
    ls * | wc -l
    0
    ksh: 561582 Killed

  2. without provide "*" wildcard, the result can be return
    ls | wc
    273 273 6383

  3. ulimit setting
    ulimit -a
    time(seconds) unlimited
    file(blocks) unlimited
    data(kbytes) unlimited
    stack(kbytes) unlimited
    memory(kbytes) unlimited
    coredump(blocks) unlimited
    nofiles(descriptors) 8196

2

May I ask you how many files are in that directory?
I may be you reached the maximum argument a command (here ls) can take
A workaround is to use | xargs

3

This is exactly what is happening.

4

it is only 273 files inside the directory, what is the limit?

5

Probably system is compromised. Usually this is symptom of "root-kit". Or hacker may have changed some libraries

6

Does this still happen when using options? Such as ls -l for example.

7

The problem is not a filesystem limit, the problem is a commandline limit: when you enter a command with a (shell-)variable or wildcard, like you entered "ls -l *sh" then the shell will expand the wildcard to all the filenames it is representing. Only then it will call the binary (ls in this case) and feed it whatever the wildcard has expanded to.

Example:

# ls -l
total 55
-rwxr-xr--   1 root     system        20455 Jan 08 12:03 a.sh
-rw-------   1 root     system         2527 Dec 08 2006  b.sh
-rwxr-xr--   1 root     system         5617 Feb 20 13:24 c.sh

We enter a command:

# ls -l *sh

Now, before giving the command to ls, the shell looks up what "*sh" represents and expands that to "a.sh b.sh c.sh". The command line now looks like:

# ls -l a.sh b.sh c.sh

Only now "ls" is called and fed the rest of the command line.

Alas, command lines cannot grow ad infinitum. POSIX has a limit of 4k characters and exactly this limit is exceeded in your case as the last value in your output of wc (the number of characters) shows. This is a pretty common gotcha in shell scripting and the common solution is to avoid constructions like that and use "find" instead. Your command above could be safely written this way:

find . -type f -name "*sh" -print | wc -l

I hope this helps.

bakunin

8

Thank for your detail explanation. I have two more questions hope you can give me some clue as well.

  1. if using ls with wildcard , it is quite easy to exceed the limit as only allow for 4k of characters?

  2. For the same case as my initial question, once i use "root" to perform
    ls *sh, the result can output on the screen without any error. What root diff from a normal user in this case?