12-05-2002
)
I got hit by a rootkit. The hacker must have shut down the daemon. Is there a way to clean out the system from the SK rootkit? Please let me know! I know a re-install is suggested but this is the second time this is happenning and I want to find a way to tackle this with the minimum downtime!!
I am running redhat linux 7.0.
Please advice...
thanks
KS
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Working out of AIX 4.3.
All logs that were written via application suddenly stopped. executing a tail -f <logfile> was not producing any results.
Tried to refresh the syslogd (daemon). When executing "refresh -s syslogd" system would display
<<0513-036 The request could not be passed to... (2 Replies)
Discussion started by: buRst
2 Replies
2. UNIX for Advanced & Expert Users
I would like to start up multiple instances of syslog daemon. I am having a little difficulty. Is this at all possible?
I have separate syslog.conf1.... syslog.conf5 files.
I have linked the daemon to separate files syslogd1 ... syslogd5
I have arranged the rcd.2 start/stop scripts for... (9 Replies)
Discussion started by: Gary Dunn
9 Replies
3. UNIX for Advanced & Expert Users
I have a remote syslog server which is recieving messages from many hosts. I would like it to log them in seperate files denoted by hostname . For example all messages for host1 in a directory of the same name. Is there an easy way to do this using syslogd? I have a feeling syslog-ng provides this... (3 Replies)
Discussion started by: silvaman
3 Replies
4. Solaris
Hi friends,
is it possible to ignore special messages with syslogd? we have some errors that are firmware issues an no real faults. we serach for a way to ignore ONLY these messages... OS is solaris 10...
any ideas?
tia,
DN2 (1 Reply)
Discussion started by: DukeNuke2
1 Replies
5. AIX
Hi,
I wanted to log some authentication information, so I added following line to /etc/syslog.conf:
auth.info /home/vilius/dir1/eeerrr.log
After that I refreshed syslogd subsystem:
refresh -s syslogd
To check my logging I made few unsuccessfull attempts to login as root using ssh and... (1 Reply)
Discussion started by: vilius
1 Replies
6. Solaris
Hi All,
I can seem to find the syslog daemon in the /etc/init.d/ dir. i have made change to the syslog.conf i need to restart the daemon. am using solaris 10. i have no problem on version 9
Anyone with a template i can use for log review for auditing purposes. (1 Reply)
Discussion started by: lottiem
1 Replies
7. Linux
I'm recieving from time to time such messages:
Message from syslogd@localhost at Sat Jul 8 18:29:58 2006 ...
localhost kernel: Disabling IRQ #17
What could cause such messages? How can I at least disable these messages which are posted on all terminals?
Note:
$ uname -a
Linux... (19 Replies)
Discussion started by: Hitori
19 Replies
8. AIX
Hi Guys,
I am configuring syslogd for Message broker.
I know that we have to add a line user.* /var/log/wmb.log
to the /etc/syslog.conf file.
I want to know what userid does the user in user.* take?
Thanks (1 Reply)
Discussion started by: vandi
1 Replies
9. Solaris
Hi ,
Iam using Solaris8 and as I checked I found syslogd process not running
can please somebody suggest me the way to start it. (2 Replies)
Discussion started by: Laxxi
2 Replies
10. Solaris
Where do I configure where syslogd writes to log files?
I've got open files in an archive directory called errlog.131017 and audlog.131017 and, having run an fuser, it appears that syslogd is writing to these files. (3 Replies)
Discussion started by: psychocandy
3 Replies
RHNSD(8) Red Hat, Inc. RHNSD(8)
NAME
rhnsd - A program for querying the Spacewalk server for updates and information.
SYNOPSIS
rhn_check [options]
DESCRIPTION
rhnsd is a background daemon process that periodically polls the Spacewalk server to see if there are any queued actions available. If any
are queued, rhnsd will execute those actions.
rhnsd is typically started from the initialization (init) scripts in /etc/init.d/rhnsd. when it's time to poll the Spacewalk server for
available updates and actions. The default interval is every 240 minutes. The minimum polling interval is 60 minutes.
To check for updates, rhnsd runs an external program called rhn_check. This is a small application that actually makes the network connec-
tion to Spacewalk.
The rhnsd daemon does not listen on any network ports, nor does it ever talk to the network directly. Any network activity is done via the
rhn_check utility.
rhnsd can be configured by editing the /etc/sysconfig/rhn/rhnsd. configuration file. This is actually the configuration file the rhnsd
initialization script /etc/init.d/rhnsd. uses.
OPTIONS
-i, --interval
Specify the interval that rhnsd should wait between checking the Spacewalk. Default is 240 minutes, the minimum is 60 minutes. This
can also be specified in /etc/sysconfig/rhn/rhnsd
-f, --foreground
force the rhnsd process to run in the foreground instead of automatically backgrounding itself, as it does by default.
FILES
/etc/sysconfig/rhn/rhnsd
Configuration settings for the rhnsd daemon's initialization script.
SEE ALSO
rhn_check(8), rhn_register(8), rhnsd(8), rhn-profile-sync(8), rhnplugin(8), up2date(5).
AUTHORS
Preston Brown <pbrown@redhat.com>
Cristian Gafton <gafton@redhat.com>
Adrian Likins <alikins@redhat.com>
James Bowes <jbowes@redhat.com>
BUGS
Report bugs to <http://bugzilla.redhat.com>.
COPYRIGHT
Copyright (C) 1999-2006 Red Hat, Inc.
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICU-
LAR PURPOSE.
Linux 2006 November 13 RHNSD(8)