topic Re: /dev/null changes to ordinary file in Operating System - HP-UX

/dev/null changes to ordinary file

Patricio Besteiro — Wed, 07 Sep 2011 17:15:43 GMT

could you guys help me to create a script to check which process is modifying /dev/null from a character device to an ordinary file?

thanks in advance!!

Re: /dev/null changes to ordinary file

James R. Ferguson — Wed, 07 Sep 2011 17:48:57 GMT

Hi:

The 'root' user should be the only one capable of removing '/dev/null'. The recreation is likely a consequence of a subsequent redirection to '/dev/null' after the device file has been removed.

You might be able to pin-point the time and by inference the person responsible by looking at a command history ('${HOME}/.sh_history'). You should also examine all scripts that 'root' runs (e.g. crontasks) to look for errant 'rm' commands.

Regards!

...JRF...

Re: /dev/null changes to ordinary file

Dennis Handly — Thu, 08 Sep 2011 16:05:41 GMT

If JRF's suggestions don't help you find the cause, you may have to turn on auditing.

You can also look at the time stamp of /dev to see when null was removed: ll -d /dev