Is something generating files at the root of the system?

Question

linux

A development server, it seems to be nothing to worry about, but an empty file appears every 30 seconds.

-rw-r--r--   1 root root         0 Aug  4 15:09 .r.172.86.o
-rw-r--r--   1 root root         0 Aug  4 15:22 .r.172.87.l
-rw-r--r--   1 root root         0 Aug  4 15:22 .r.172.87.o
-rw-r--r--   1 root root         0 Aug  4 14:59 .r.172.88.l
-rw-r--r--   1 root root         0 Aug  4 14:59 .r.172.88.o
-rw-r--r--   1 root root         0 Aug  4 15:20 .r.172.89.l
-rw-r--r--   1 root root         0 Aug  4 15:19 .r.172.89.o
-rw-r--r--   1 root root         0 Aug  4 15:26 .r.172.8.l
-rw-r--r--   1 root root         0 Aug  4 15:26 .r.172.8.o
-rw-r--r--   1 root root         0 Aug  4 15:11 .r.172.90.l
-rw-r--r--   1 root root         0 Aug  4 15:11 .r.172.90.o
-rw-r--r--   1 root root         0 Aug  4 14:20 .r.172.91.l
-rw-r--r--   1 root root         0 Aug  4 14:20 .r.172.91.o
-rw-r--r--   1 root root         0 Aug  4 15:10 .r.172.92.l
-rw-r--r--   1 root root         0 Aug  4 15:10 .r.172.92.o
-rw-r--r--   1 root root        56 Aug  4 15:25 .r.172.93.l
-rw-r--r--   1 root root       303 Aug  4 15:25 .r.172.93.o
-rw-r--r--   1 root root        19 Aug  4 14:49 .r.172.94.l
-rw-r--r--   1 root root       101 Aug  4 14:49 .r.172.94.o
-rw-r--r--   1 root root         0 Aug  4 14:19 .r.172.95.l
-rw-r--r--   1 root root         0 Aug  4 14:19 .r.172.95.o
-rw-r--r--   1 root root        38 Aug  4 15:09 .r.172.96.l
-rw-r--r--   1 root root       202 Aug  4 15:09 .r.172.96.o
-rw-r--r--   1 root root         0 Aug  4 15:06 .r.172.97.l
-rw-r--r--   1 root root         0 Aug  4 15:06 .r.172.97.o
-rw-r--r--   1 root root         0 Aug  4 15:15 .r.172.98.l
-rw-r--r--   1 root root         0 Aug  4 15:15 .r.172.98.o
-rw-r--r--   1 root root        19 Aug  4 15:21 .r.172.99.l
-rw-r--r--   1 root root       101 Aug  4 15:21 .r.172.99.o
-rw-r--r--   1 root root         0 Aug  4 15:13 .r.172.9.l
-rw-r--r--   1 root root         0 Aug  4 15:13 .r.172.9.o

100 I am sure that the system is infected, someone is using it and not from our team.
Because some user appeared, which I then deleted.

+ In addition, a number of utilities were banned, such as curl/htop/...

Answer 1

If you want scandals, intrigues, delusions - remove the image, then format it and roll the backup.
If you don't want to, just expand the backup.
No backup - SSZB.

Answer 2

1. files are created from root, so it will be a little more difficult to find them, any root process can create them.
2. It doesn't look like it's a cron - it can't take half a minute, the minimum interval is a minute, so most likely it's some kind of already running process. But to clear your conscience, you can also view the crowns.
What exactly is in the files?

Answer 3

Use the fatrace program .