Re: KCORE Change

From: Brett Franck (bfranck_at_perfectnetusa.com)
Date: 10/17/03

  • Next message: Marcel.Stegehuis_at_12move.nl: "Kickstart" 
    To: <redhat-list@redhat.com>
Date: Fri, 17 Oct 2003 09:37:20 -0500

    ----- Original Message -----
    From: "Bret Hughes" <bhughes@elevating.com>
    To: <redhat-list@redhat.com>
    Sent: Friday, October 17, 2003 9:33 AM
    Subject: Re: KCORE Change

    > On Fri, 2003-10-17 at 09:15, Brett Franck wrote:
    > > All,
    > >
    > > My tripwire reported this this morning.......anyone know exactly why
    this would change if I haven't done a Kernel upgrade? The only thing that I
    can think of that may have affected anything is I recently shut off
    "portmap" because I'm not using NFS.
    > >
    > >
    > >
    > > Rule Name: Critical devices (/proc/kcore)
    > > Severity Level: 100
    >
    > --------------------------------------------------------------------------
    -----
    > >
    > > Modified:
    > > "/proc/kcore"
    >
    > --------------------------------------------------------------------------
    -----
    > >
    > >
    > > TWUPD details show this......concerns me.
    > >
    > > Rule Name: Critical devices (/proc/kcore)
    > > Severity Level: 100
    >
    > --------------------------------------------------------------------------
    -----
    > > ----------------------------------------
    > > Modified Objects: 1
    > > ----------------------------------------
    > >
    > > Modified object name: /proc/kcore
    > >
    > > Property: Expected Observed
    > > ------------- ----------- -----------
    > > Object Type Regular File Regular File
    > > Device Number 2 2
    > > File Device Number 0 0
    > > Mode -r-------- -r--------
    > > UID root (0) root (0)
    > > GID root (0) root (0)
    > > * Size 268423168 335532032
    > >
    > >
    >
    > Hmm kcore IIRC is a representation of the system's memory since the size
    > changed, I have to wonder if you add some memory. I don't have this
    > file I wonder what generates it?
    >
    >
    > Bret
    >
    >
    > --
    > redhat-list mailing list
    > unsubscribe mailto:redhat-list-request@redhat.com?subject=unsubscribe
    > https://www.redhat.com/mailman/listinfo/redhat-list
    >

    Oh, yeah, um, well, yeah right I did that too.......I added another 64MB ram
    to my box.....who'd a thunk that a memory size increase would send Tripwire
    into alarm?

    Thanks Bret!! :-)

    Brett 

    -- 
redhat-list mailing list
unsubscribe mailto:redhat-list-request@redhat.com?subject=unsubscribe
https://www.redhat.com/mailman/listinfo/redhat-list
  • Next message: Marcel.Stegehuis_at_12move.nl: "Kickstart"