cancel
Showing results for 
Search instead for 
Did you mean: 

/dev/null

 
SOLVED
Go to solution
Steve_3
Frequent Advisor

/dev/null

For some reason the character special file /dev/null is getting changed to
a regular file with 666 permission and
root root as user and group.

How can I track what is changing the
/dev/null special file.

Thanks,
steve
7 REPLIES 7
Michael Tully
Honored Contributor
Solution

Re: /dev/null

Hi,

If this is a regular occurance it could
be that there is a problem within a
script that runs from cron. Suggest you
have a look at unfamiliar jobs that run
out of cron or any other scheduling
package that you may have.

-Michael
Anyone for a Mutiny ?
Sridhar Bhaskarla
Honored Contributor

Re: /dev/null

Since it is getting changed to a regular file, check the time stamp and contents of the file and see when it got created/modified. Probably you can get a hint there.

-Sri
You may be disappointed if you fail, but you are doomed if you don't try
Ulrich Deiters
Frequent Advisor

Re: /dev/null

This can happen if you try to
send unwanted program output
to /dev/null by something
like
verbose_program 2>/dev/null.
Check your cron-scheduled jobs
for occurences of /dev/null.
Darrell Allen
Honored Contributor

Re: /dev/null

Hi Steve,

Is the inode number getting changed (ll -i /dev/null)? If so, then something is removing /dev/null and recreating it. That could be done with either an rm or mv command.

Simply redirecting stdout or stderr to /dev/null will not change it to a regular file although the date/timestamp will change.

Darrell
"What, Me Worry?" - Alfred E. Neuman (Mad Magazine)
James R. Ferguson
Acclaimed Contributor

Re: /dev/null

Hi Steve:

I agree with Darrell insofar as if /dev/null has become a regular file instead of a special one, then something has removed it.

HOWEVER, the "something" that removes it probably isn't the same "something" that creates it. Once removed, *any* redirection to /dev/null will result in the creation of a regular file.

I'd start by examining scripts for '/dev/null' and/or 'rm'.

You can automate your search by doing something like:

# find . -type f -print |xargs grep rm /dev/null

This will expose all files by name in the current directory with a string "rm".

Regards!

...JRF...
Darrell Allen
Honored Contributor

Re: /dev/null

Good clarification James.

I was thinking of a single script removing /dev/null and recreating it. I agree that more than likely "something" is removing /dev/null and it is being recreated by another process which could indeed be (and probably is) redirecting output to /dev/null.

Also, if /dev is owned by bin:bin with perms 555, that "something" is apparantly being done by root. A normal user wouldn't be able to delete /dev/null.

Darrell
"What, Me Worry?" - Alfred E. Neuman (Mad Magazine)
Steve_3
Frequent Advisor

Re: /dev/null

Thanks for all the reply.
This issue is resolved.

Thanks,
steve