On Sun, 2008-07-20 at 22:04 +0100, Anne Wilson wrote: > On Sunday 20 July 2008 21:23:52 Stephen Harris wrote: > > > > What does > > find /var/spool/cron -type f ! -size 0 > > show? > > > Does that mean 'not = size 0'? > Yes. > > I can't think of anything that explains this. I have a 6-month-old CentOS 5.2 > install, with nothing out of the ordinary, as far as I can recall. > Your previous message showed: -rw------- 1 root root 0 Jul 7 16:07 /var/spool/cron/nobody This will be the last modification date/time, and possibly the creation date/time if the file was not modified at all. So something around July 7 presumably caused it. If you have the old /var/log/messages files from around that date, then looking through those might show something. As might a /var/log/yum.log file which could indicate if something was automatically installed. John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 E-mail: John.Horne at plymouth.ac.uk Fax: +44 (0)1752 587001