/dev/null

[Steve_3]

For some reason the character special file /dev/null is getting changed to
a regular file with 666 permission and
root root as user and group.

How can I track what is changing the
/dev/null special file.

Thanks,
steve

[Michael Tully · Accepted solution]

Hi,

If this is a regular occurance it could
be that there is a problem within a
script that runs from cron. Suggest you
have a look at unfamiliar jobs that run
out of cron or any other scheduling
package that you may have.

-Michael

[Sridhar Bhaskarla]

Since it is getting changed to a regular file, check the time stamp and contents of the file and see when it got created/modified. Probably you can get a hint there.

-Sri

[Ulrich Deiters]

This can happen if you try to
send unwanted program output
to /dev/null by something
like
verbose_program 2>/dev/null.
Check your cron-scheduled jobs
for occurences of /dev/null.

[Darrell Allen]

Hi Steve,

Is the inode number getting changed (ll -i /dev/null)? If so, then something is removing /dev/null and recreating it. That could be done with either an rm or mv command.

Simply redirecting stdout or stderr to /dev/null will not change it to a regular file although the date/timestamp will change.

Darrell

[James R. Ferguson]

Hi Steve:

I agree with Darrell insofar as if /dev/null has become a regular file instead of a special one, then something has removed it.

HOWEVER, the "something" that removes it probably isn't the same "something" that creates it. Once removed, *any* redirection to /dev/null will result in the creation of a regular file.

I'd start by examining scripts for '/dev/null' and/or 'rm'.

You can automate your search by doing something like:

# find . -type f -print |xargs grep rm /dev/null

This will expose all files by name in the current directory with a string "rm".

Regards!

...JRF...

[Darrell Allen]

Good clarification James.

I was thinking of a single script removing /dev/null and recreating it. I agree that more than likely "something" is removing /dev/null and it is being recreated by another process which could indeed be (and probably is) redirecting output to /dev/null.

Also, if /dev is owned by bin:bin with perms 555, that "something" is apparantly being done by root. A normal user wouldn't be able to delete /dev/null.

Darrell

[Steve_3]

Thanks for all the reply.
This issue is resolved.

Thanks,
steve