We did find out after getting the problem fixed that our WebSphere Admin
had mistyped a command they use to clear a log file (did a mv on /dev/null
instead of a cp)...we've changed their procedure so they don't do either
command anymore!
John Summerfield
<[EMAIL PROTECTED]
homelinux.org> To
Sent by: Linux on [email protected]
390 Port cc
<[EMAIL PROTECTED]
IST.EDU> Topic
Subject
01/14/2008 06:11 Re: Linux not recognizing file
PM systems
Please respond to
Linux on 390 Port
<[EMAIL PROTECTED]
IST.EDU>
Joell Chockley wrote:
> I've got a strange problem with a Linux guest. The only indicator we've
> come up with so far is that /dev/null had it's file permissions changed
on
> Friday afternoon to -rw-r--r-- 1 root root 81 2008-01-11 15:03 /dev/null
> (we don't know how this was changed). One of our admins changed it back
to
>
This is what I would expect to see if someone deleted /dev/null and then
root did something like
echo >/dev/null
as you would expect root to do sometimes - just look at /etc/init.d/*
grep /dev/null /etc/init.d/*
_I_ would like to know who|what deleted /dev/null and what else was
done, it sounds to me like a breakdown in procedures, or some malware
was installed.
--
Cheers
John
-- spambait
[EMAIL PROTECTED] [EMAIL PROTECTED]
-- Advice
http://webfoot.com/advice/email.top.php
http://www.catb.org/~esr/faqs/smart-questions.html
http://support.microsoft.com/kb/555375
You cannot reply off-list:-)
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or
visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
CONFIDENTIALITY NOTICE: This email message and any attachments are for the sole
use of the intended recipient(s) and may contain proprietary, confidential,
trade secret or privileged information. Any unauthorized review use,
disclosure or distribution is prohibited and may be a violation of law. If you
are not the intended recipient or a person responsible for delivering this
message to an intended recipient, please contact the sender by reply email and
destroy all copies of the original message.
----------------------------------------------------------------------
For LINUX-390 subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: INFO LINUX-390 or visit
http://www.marist.edu/htbin/wlvindex?LINUX-390
