This shared memory I assume and not something to be alarmed at.
Received From: lenovo3->rootcheck Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)." Portion of the log(s): File '/dev/shm/pulse-shm-3257873433' present on /dev. Possible hidden file. System is ubuntu desktop 8.04 updated ossec is 1.5 but I see there is a 1.6 - will install shortly Thanks Martin
