Koozali.org: home of the SME Server

Obsolete Releases => SME Server 7.x => Topic started by: hjnvejlen on June 24, 2008, 11:19:50 PM

Title: rkhunter: process using deleted files
Post by: hjnvejlen on June 24, 2008, 11:19:50 PM
I have during the last 2 weeks or so received messages from RKHunter about:

Warning: The following processes are using deleted files:
         Process: (deleted)    PID: 3122    File: /usr/bin/perl.#prelink#
         Process: (deleted)    PID: 4319    File: /usr/bin/perl.#prelink#
         Process: (deleted)    PID: 4550    File: /usr/bin/perl.#prelink#

My problem is that I'm not sure what the real problem is and what I can do to solve it.

In my opinion it may mean either of these scenarios:

a process is wanting to use a file which has been deleted. This can be a problem since that process can't run correct.

or

a process is accessing a file which is supposed to be deleted. But on the other hand I haven't heard that Linux can access deleted files??

As I prefer to have as few warnings from my system, and I don't like to receive warnings that I don't understand I appriciate some help :-)
Title: Re: rkhunter: process using deleted files
Post by: mrjhb3 on June 25, 2008, 02:56:21 AM
Check the bugtracker, there is already an issue opened about this.

John