Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have never seen this files in RedHat before.


What could it be?

share|improve this question
up vote 4 down vote accepted

If your computer gets its IP-address by DHCP, this is probably dhclient. Check with lsof -n | grep orbit as root.


Looks like the ssh-agent-process. This makes it possible to cache your passphrase when you attempt to do ssh-logins on servers using a key with passphrase, so you don't have to type it in every time.


Looks like the gnome-keyring-daemon. This stores several credentials for you. This is the socket other applications talk through when they want to fetch credentials from it.

share|improve this answer
Can the second file used by malware or rootkit? I have some suspicions about it. Because this file didn't exist there before. – shatzibtten Nov 7 '11 at 18:21
Probably not Malware - it's normal as long as someone is logged in to Gnome. Do you have an ssh-agent running (ps aux | grep ssh-agent)? Check if it has the files open with lsof -n | grep ssh-agent as root. My guess is that the agent.14981-file is the unix-socket the agent uses. Regardless, it's safe to kill it off - the only consequence is that ssh can't cache the passphrase of ssh-keys. (The ssh-agent may also run without Gnome, it just has to be started somehow) – Kvisle Nov 7 '11 at 18:40
Thanks ! Your answer has helped me to understand. – shatzibtten Nov 7 '11 at 19:06

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.