| View previous topic :: View next topic |
| Author |
Message |
piratwww
n00b
Joined: 05 Jan 2010
Posts: 6
Location: Germany/Montabaur
|
 Posted: Wed Jan 13, 2010 4:58 am Post subject: [solved] Device null will be always delete |
 |
|
Hey,
since not long ago I have problems with /dev/null on my server.
Always something change the device /dev/null. When I start the Server, the device is ok:
| Code: | | 0 crw-rw-rw- 1 root root 1, 3 12. Jan 19:17 /dev/null |
After this in any time something change the property from device to a usual file, in odd time something delete the device. I don't know what script, program can do this. I have stopped syslog for many hours, no change: | Code: | | 0 -rw-r--r-- 1 root root 0 13. Jan 06:02 /dev/null |
.
piratwww
Last edited by piratwww on Thu Jan 14, 2010 11:44 am; edited 1 time in total |
|
| Back to top |
|
 |
eccerr0r
Watchman
Joined: 01 Jul 2004
Posts: 9892
Location: almost Mile High in the USA
|
| Posted: Wed Jan 13, 2010 6:34 pm Post subject: |
|
|
Well, likely it happened Jan 13 6:02 at your localtime, do you have any cron jobs running at that time?
I'd check for rootkits if you know you have no administrative accounts active running things then...
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching? |
|
| Back to top |
|
|
piratwww
n00b
Joined: 05 Jan 2010
Posts: 6
Location: Germany/Montabaur
|
| Posted: Thu Jan 14, 2010 11:44 am Post subject: |
|
|
Hey,
I silly boy! Thanks eccerr0r! I has stopped the false device. Through your suggestion I stopp now the right device: vixie-cron and now I see that there are no elves, who are want to change my null device. About 12 hours there was no change to the null device. Now i check step by step my home-made scripts, witch are started by cron.
Yet I have a question to your post, because i don't understand exactly. What do you mean, what are your minds behinds the dots: "running things then...". Do you mean that there actually no more possibilities except cron? Or do you think about other things? Let it me know. Thanks! 
In hope, that the mistake is found, i set this thread to solved.
Thanks!!!!
piratwww |
|
| Back to top |
|
|
eccerr0r
Watchman
Joined: 01 Jul 2004
Posts: 9892
Location: almost Mile High in the USA
|
| Posted: Thu Jan 14, 2010 3:29 pm Post subject: |
|
|
I suppose I just don't want to rule out the possibility of unauthorized administrative accounts.
Glad you found out what was causing the problem.
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching? |
|
| Back to top |
|
|
|
Kernel & Hardware
