Tripwire reports /proc/kcore has increased in size
"Chris de Vidal" <[email protected]>
| Newsgroups | gmane.linux.admin.managers |
|---|---|
| Message-ID | <[email protected]> |
I got a tripwire report today that showed /proc/kcore had increased in size by almost 10MB. This has never happened on any other server I've run. * I haven't added RAM. * I haven't rebooted. * I haven't adjusted the swapfile. I have, however, started running a firewall script. So I flushed iptables and removed all the extra chains but kcore is the same size. If my system had started swapping due to the extra load from the firewall, would that explain the increase? Or should I now be thinking about forensics+restore from backup now, meaning a cracker got in? Thanks! /dev/idal _______________________________________________ LinuxManagers mailing list - http://www.linuxmanagers.org submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected] subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers