unauthorized device file--Local Security Finding

[SSO Montgomery]

I don't know what is generating this file:

crw------- 1 root root 203 0x015000 Mar 12 11:17 /var/tmp/rdskKPJa04161

I deleted it and rebooted the machine (yesterday), and one reappeared. Apparently, a G076, local security, finding is generated when a character special (crw-----) device file is found outside the normal device directory structure.

Does anyone have any idea what may be generating this file??? Would appreaciate any ideas. This is a K370 system running 11.11, 64 bit.





crw------- 1 root root 203 0x015000 Mar 12 11:17 /var/tmp/rdskKPJa04161

[John Poff]

Hi,

Here is a thread that says they are left behind when sam is improperly terminated. I just looked on a couple of our boxes and we have some of those old files out there too.

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x0d7f972194d6d5118ff40090279cd0f9,00.html

JP

[Chris Wong]

Did it show up immediately after the reboot (was it created during one of the startup processes?) or later?

[Jeff Schussele]

Hi,

That's a ctl Class device using the sctl driver.
Most frequently used by the auto-loader fro tape libraries.
I have no clue *why* it's being created in /var/tmp, but I'd suspect that some sort of application (Tape Backup SW?) is doing this as /var/tmp is widely used by apps for temp storage.

Rgds,
Jeff

[SSO Montgomery]

Chris: Yes. It's the first thing I checked after the reboot.

Others: Will get back to you after checking out backup processes/procedures.

Thanks.

[SSO Montgomery]

Everyone:

Thank you so much. Was application doing tape_backup.

Chow.