Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This was in a recent Tripwire report of a Debian Linux (virtual) server:

### Attr        Observed (what it is)         Expected (what it should be)
### =========== ============================= =============================
/dev/char/253:0
    md5 (sig1): 3cArKelJk8b0VTK4Q80.nV        3Z4Cv6zdER0tKfg3lDqPM3

First of all, what is /dev/char/253:0? Secondly, should I be concerned that it changed?

UPDATE. One of my colleagues said that this can happen with a server reboot, which, since I had rebooted the server the previous day, is probably what triggered the Tripwire alert.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

The /dev folder is where linux stores files generally associated with devices. Most of these are special files that are mapped or linked with individual devices, such as hard drives, cd-roms, USB devices, etc..

It would seem to me that monitoring these files for changes would result in a lot of changes being detected, depending on the device and how the file is used. I haven't worked with a /char directory too frequently, but I believe it contains "Character Devices," which are characterwise/steraming interfaces, as opposed to block devices, such as hard drives and CD-ROMs.

To answer your question, I would think you could safely disregard this message, after verifying that whatever device is mapped to 253:0 is expected.

For more information, check out:

http://tldp.org/LDP/sag/html/dev-fs.html

and

http://en.wikipedia.org/wiki/Device_file#Character_devices

share|improve this answer
    
You said "verifying that whatever device is mapped to 253:0 is expected". How do I find out what that device is? (The server is a virtual machine.) –  user35042 Jun 20 '12 at 20:54
    
Unfortunately, I'm not sure. I'm mostly used to working with RedHat/CentOs, and I've never seen the /char directory pop up in the /dev folder, nor do I know how Debian maps streaming devices (although 253:0 definitely looks like some sort of mapping). You could do a grep on /var/log/messages, see if that "253:0" pops up anywhere. I just saw your update though, and that definitely sounds possible, again, depending on what device is associated with that file, and how the device uses the file. –  John K Jun 21 '12 at 13:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.