Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am receiving the following errors from rkhunter. I have recently upgraded my server from lenny to squeeze and this may have caused the problem. How do I fix this or hide the error messages?

Warning: The modules file '/proc/modules' is missing.
Warning: Suspicious file types found in /dev:
         /dev/shm/network/ifstate: ASCII text
Warning: Hidden directory found: /dev/.udev

I also not get a second email: Please inspect this machine, because it may be infected. Please can anybody point me in the right direction to find the cause of these errors?

share|improve this question
You can disable the test loaded_modules (not os_specific). – user168476 Apr 8 '13 at 7:41
up vote 14 down vote accepted

First of all, they are only warnings, not errors.

Warning: The modules file '/proc/modules' is missing.

rkhunter is trying to check the kernel modules, but it cannot because the file /proc/modules doesn't exist. You can disable the test by changing the below line:

DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps" 


DISABLE_TESTS="suspscan hidden_procs deleted_files packet_cap_apps os_specific" 

About the second warning:

Warning: Suspicious file types found in /dev:
         /dev/shm/network/ifstate: ASCII text

If /dev/shm/network/ifstate is a known good file, you can white-list it by adding the following line in /etc/rkhunter.conf:


About the third line:

Warning: Hidden directory found: /dev/.udev

Similar to above, to avoid this warning, you can reconfigure rkhunter to ignore this directory:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.