Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A large number of cracker files with name FOO** are created by some of the process. I executed following command to found culprit process lsof -f -F /tmp/*

But didn't found anything useful.

Is there any better way to catch culprit process.

share|improve this question
mmm, crackers... – glenn jackman Apr 26 '11 at 15:04
Out of curiousity, what do you mean by "cracker files" anyway? – DictatorBob Apr 26 '11 at 19:29
up vote 0 down vote accepted
lsof |grep FOO # should give a listing of processes that are creating at that time files with the name FOO

if there is not output from this you may need to setup a cronjob do list every minute - I'm thinking perhaps the process is not running all the time. if nothing comes up from this look when the files were created

stat FOO

look at the owner/permissions/modification time etc. and see if something may tell you something

share|improve this answer

You'll want to use the audit subsystem to track down the rogue process.

share|improve this answer
I can't use audit subsystem. Any alternate idea ? – vnix27 Apr 26 '11 at 11:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.