Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

A large number of cracker files with name FOO** are created by some of the process. I executed following command to found culprit process lsof -f -F /tmp/*

But didn't found anything useful.

Is there any better way to catch culprit process.

share|improve this question
    
mmm, crackers... –  glenn jackman Apr 26 '11 at 15:04
    
Out of curiousity, what do you mean by "cracker files" anyway? –  Some Guy Apr 26 '11 at 19:29
add comment

2 Answers

up vote 0 down vote accepted
lsof |grep FOO # should give a listing of processes that are creating at that time files with the name FOO

if there is not output from this you may need to setup a cronjob do list every minute - I'm thinking perhaps the process is not running all the time. if nothing comes up from this look when the files were created

stat FOO

look at the owner/permissions/modification time etc. and see if something may tell you something

share|improve this answer
add comment

You'll want to use the audit subsystem to track down the rogue process.

share|improve this answer
    
I can't use audit subsystem. Any alternate idea ? –  vnix27 Apr 26 '11 at 11:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.