history/history.db files appearing

[Greg Marks]

On a computer running Debian 10, in a number of directories a
subdirectory "history" has mysteriously appeared containing a
file history.db. There are 11 of these history.db files in various
places in my home directory; cmp reveals that they are all identical.
Each is an "SQLite 3.x database, last written using SQLite version
3027002." Each is a 12288-byte file containing, in addition to a
bunch of special characters, the words: "tableversionversionCREATE
TABLE version ( version VARCHAR NOT NULL, datfile VARCHAR UNIQUE NOT
NULL)-Andexsqlite_autoindex_version_1version." In some (but not all)
cases the timestamp on history/history.db matches the timestamp of some
file I was editing with vim 8.1.1401 in the same directory containing the
history subdirectory--for whatever that's worth--but I can't reproduce
the phenomenon by editing similar files with vim. All history/history.db
files appeared since upgrading from Debian 9. I couldn't find anything
relevant in the log files around the timestamps of the mystery files.

Does anyone know what might be causing this? As far as I can tell it's
harmless, but it is a bit disquieting when files start appearing that
I didn't intentionally create.

Regards,
Greg Marks

[David]

Post by Greg Marks
On a computer running Debian 10, in a number of directories a
subdirectory "history" has mysteriously appeared containing a
file history.db.

[...]

Post by Greg Marks
Does anyone know what might be causing this?

I don't know the answer, but you might find some clues here:
https://codesearch.debian.net/search?q=history.db&literal=1
Note the list of package names at the top of the page.

[Andrew McGlashan]

Hi,

https://codesearch.debian.net/search?q=history.db&literal=1 Note
the list of package names at the top of the page.

Why is it not accessible via the Tor network? :(

A.

[Judah Richardson]

Do you have some kind of backup, sync, or versioning application running?

Post by Greg Marks
On a computer running Debian 10, in a number of directories a
subdirectory "history" has mysteriously appeared containing a
file history.db. There are 11 of these history.db files in various
places in my home directory; cmp reveals that they are all identical.
Each is an "SQLite 3.x database, last written using SQLite version
3027002." Each is a 12288-byte file containing, in addition to a
bunch of special characters, the words: "tableversionversionCREATE
TABLE version ( version VARCHAR NOT NULL, datfile VARCHAR UNIQUE NOT
NULL)-Andexsqlite_autoindex_version_1version." In some (but not all)
cases the timestamp on history/history.db matches the timestamp of some
file I was editing with vim 8.1.1401 in the same directory containing the
history subdirectory--for whatever that's worth--but I can't reproduce
the phenomenon by editing similar files with vim. All history/history.db
files appeared since upgrading from Debian 9. I couldn't find anything
relevant in the log files around the timestamps of the mystery files.
Does anyone know what might be causing this? As far as I can tell it's
harmless, but it is a bit disquieting when files start appearing that
I didn't intentionally create.
Regards,
Greg Marks

[Richard Hector]

Post by Greg Marks
On a computer running Debian 10, in a number of directories a
subdirectory "history" has mysteriously appeared containing a
file history.db. There are 11 of these history.db files in various
places in my home directory; cmp reveals that they are all identical.
Each is an "SQLite 3.x database, last written using SQLite version
3027002." Each is a 12288-byte file containing, in addition to a
bunch of special characters, the words: "tableversionversionCREATE
TABLE version ( version VARCHAR NOT NULL, datfile VARCHAR UNIQUE NOT
NULL)-Andexsqlite_autoindex_version_1version." In some (but not all)
cases the timestamp on history/history.db matches the timestamp of some
file I was editing with vim 8.1.1401 in the same directory containing the
history subdirectory--for whatever that's worth--but I can't reproduce
the phenomenon by editing similar files with vim. All history/history.db
files appeared since upgrading from Debian 9. I couldn't find anything
relevant in the log files around the timestamps of the mystery files.

Are they open by some process? Check with lsof.

Any clues from what directories they appear in? Are they in home
directories? /etc tree? /var tree?

If you're familiar with sqlite (or even sql, and can google the
specifics), you could dig around inside and see if you can get any clues
that way.

Richard

[David Wright]

Post by Greg Marks
On a computer running Debian 10, in a number of directories a
subdirectory "history" has mysteriously appeared containing a
file history.db. There are 11 of these history.db files in various
places in my home directory; cmp reveals that they are all identical.
Each is an "SQLite 3.x database, last written using SQLite version
3027002." Each is a 12288-byte file containing, in addition to a
bunch of special characters, the words: "tableversionversionCREATE
TABLE version ( version VARCHAR NOT NULL, datfile VARCHAR UNIQUE NOT
NULL)-Andexsqlite_autoindex_version_1version." In some (but not all)
cases the timestamp on history/history.db matches the timestamp of some
file I was editing with vim 8.1.1401 in the same directory containing the
history subdirectory--for whatever that's worth--but I can't reproduce
the phenomenon by editing similar files with vim. All history/history.db
files appeared since upgrading from Debian 9. I couldn't find anything
relevant in the log files around the timestamps of the mystery files.
Does anyone know what might be causing this? As far as I can tell it's
harmless, but it is a bit disquieting when files start appearing that
I didn't intentionally create.

You might try running a script that takes a snapshot of ps output
every minute (just processes owned by you) and then reconciling
the timestamps on the .db files with what you were running at the
time. I get the impression that you/it might be editing *within*
some other application.

Cheers,
David.

[Greg Marks]

Thank you, David, Judah Richardson, and Richard Hector, for your
suggestions; unfortunately, the appearance of the history.db files
remains a mystery.

Post by Judah Richardson
Do you have some kind of backup, sync, or versioning application
running?

I have a daily cron job that runs rsync to copy my home directory to a
backup disk. That's been running for several years without any changes.
I periodically run rsync manually as well.

Post by Judah Richardson
Are they open by some process? Check with lsof.

The commands "lsof | grep history" and "sudo lsof | grep 'history.db'"
return nothing.

Post by Judah Richardson
Any clues from what directories they appear in? Are they in home
directories? /etc tree? /var tree?

Nothing in /etc or /var; most are in my home directory (and now also the
backup disk to which it's been rsynced), mostly in directories where
I've edited text files, although there is also one in a Videos directory
on a different mounted drive. There is also one in /tmp. Not counting
the backups, there are 13 of these files, appearing at a handful of
times between Jul 22 and Aug 8. (The upgrade from Debian 9 to Debian 10
occurred on Jul 17.)

Post by Judah Richardson
If you're familiar with sqlite (or even sql, and can google the
specifics), you could dig around inside and see if you can get any
clues that way.

I'm not, but what I see is this:

$sqlite3 history/history.db
sqlite> .dump
PRAGMA foreign_keys=OFF;
BEGIN TRANSACTION;
CREATE TABLE version (
version VARCHAR NOT NULL,
datfile VARCHAR UNIQUE NOT NULL);
COMMIT;

(The Web browser midori keeps a history.db file in a subdirectory
of ~/.config, but its existence, size, and content are as expected;
I don't think that has anything to do with my mystery files.)

Post by Judah Richardson
On a computer running Debian 10, in a number of directories a
subdirectory "history" has mysteriously appeared containing a
file history.db. There are 11 of these history.db files in various
places in my home directory; cmp reveals that they are all identical.
Each is an "SQLite 3.x database, last written using SQLite version
3027002." Each is a 12288-byte file containing, in addition to a
bunch of special characters, the words: "tableversionversionCREATE
TABLE version ( version VARCHAR NOT NULL, datfile VARCHAR UNIQUE
NOT NULL)-Andexsqlite_autoindex_version_1version." In some (but not
all) cases the timestamp on history/history.db matches the timestamp
of some file I was editing with vim 8.1.1401 in the same directory
containing the history subdirectory--for whatever that's worth--but
I can't reproduce the phenomenon by editing similar files with vim.
All history/history.db files appeared since upgrading from Debian 9.
I couldn't find anything relevant in the log files around the
timestamps of the mystery files.

Regards,
Greg Marks