topic Re: /dev/null in Operating System - HP-UX

/dev/null

Steve_3 — Tue, 27 Nov 2001 23:09:21 GMT

For some reason the character special file /dev/null is getting changed to
a regular file with 666 permission and
root root as user and group.

How can I track what is changing the
/dev/null special file.

Thanks,
steve

Re: /dev/null

Michael Tully — Tue, 27 Nov 2001 23:17:16 GMT

Hi,

If this is a regular occurance it could
be that there is a problem within a
script that runs from cron. Suggest you
have a look at unfamiliar jobs that run
out of cron or any other scheduling
package that you may have.

-Michael

Re: /dev/null

Sridhar Bhaskarla — Tue, 27 Nov 2001 23:28:03 GMT

Since it is getting changed to a regular file, check the time stamp and contents of the file and see when it got created/modified. Probably you can get a hint there.

-Sri

Re: /dev/null

Ulrich Deiters — Thu, 29 Nov 2001 11:23:43 GMT

This can happen if you try to
send unwanted program output
to /dev/null by something
like
verbose_program 2>/dev/null.
Check your cron-scheduled jobs
for occurences of /dev/null.

Re: /dev/null

Darrell Allen — Thu, 29 Nov 2001 13:57:22 GMT

Hi Steve,

Is the inode number getting changed (ll -i /dev/null)? If so, then something is removing /dev/null and recreating it. That could be done with either an rm or mv command.

Simply redirecting stdout or stderr to /dev/null will not change it to a regular file although the date/timestamp will change.

Darrell

Re: /dev/null

James R. Ferguson — Thu, 29 Nov 2001 14:19:02 GMT

Hi Steve:

I agree with Darrell insofar as if /dev/null has become a regular file instead of a special one, then something has removed it.

HOWEVER, the "something" that removes it probably isn't the same "something" that creates it. Once removed, *any* redirection to /dev/null will result in the creation of a regular file.

I'd start by examining scripts for '/dev/null' and/or 'rm'.

You can automate your search by doing something like:

# find . -type f -print |xargs grep rm /dev/null

This will expose all files by name in the current directory with a string "rm".

Regards!

...JRF...

Re: /dev/null

Darrell Allen — Thu, 29 Nov 2001 14:36:29 GMT

Good clarification James.

I was thinking of a single script removing /dev/null and recreating it. I agree that more than likely "something" is removing /dev/null and it is being recreated by another process which could indeed be (and probably is) redirecting output to /dev/null.

Also, if /dev is owned by bin:bin with perms 555, that "something" is apparantly being done by root. A normal user wouldn't be able to delete /dev/null.

Darrell

Re: /dev/null

Steve_3 — Thu, 29 Nov 2001 15:25:14 GMT

Thanks for all the reply.
This issue is resolved.

Thanks,
steve