May 5, 2026, 11:56 PM@lisamakesstuff Random thoughts:
- I suspect the package management system of his Linux distribution. What’s he running? Perhaps a package in it is overwriting the index files.
- Perhaps the generated index.php file has a comment in it saying whence it was generated. Should just be a plain text file, have him cat it.
@futzle Thanks! I'll check that out for him, and ask which Linux distro he's using.
May 6, 2026, 12:07 AM@lisamakesstuff More thoughts:
- Check the creation timestamp of the rogue file. If it’s the middle of last night then I’d be looking for cron jobs creating it. If it’s always the same date long in the past then it’s been extracted from a package.
- On Debianish systems you can ask the package manager who owns the file with `dpkg -S /full/path/to/file`. Even an empty response is informative.