Re: warning from rkhunter

Mark Phillips schrieb:
> I recently upgraded a server to Centos 4 from an older RH distro.  
> After installing webware, my app, the boot launch, rkhunter began  
> reporting as follows:
> 
> /etc/cron.daily/01-rkhunter:
> 
> Warning: The following processes are using deleted files:
>          Process: /bin/bash    PID: 26222    File: /dev/pts/0
>          Process: /usr/bin/python    PID: 26224    File: /dev/pts/0
> 
> These PIDs are for the webware AppServer.
> 
> Is this typical and/or is it any thing I should worry about?
> 
> Also, is there something I can do to tidy this up so rkhunter will  
> pipe down?

I haven't seen this with Suse Linux so far. Maybe it's something 
particular to RH/Centos or your app? Do you get the same problem with a 
simple boilerplate application created with MakeAppWorkDir? Do you get 
the message immediately after starting your app? Does it make a 
difference when you start it manually using AppServer and when using the 
/etc/init.d script?

-- Christoph

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2008.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/