UNIX for Dummies Questions & Answers

Hi,
What are the various way's to fix /proc folder in redhat linux 7.2 and how to verify /proc folder is proper or croupted?

Thank in advance
Bache Gowda

The /proc filesystem is dynamically maintained by the kernel. It is not a true filesystem containing "real" files...

My first question would be: what leads you to believe that /proc is not behaving in the way that it should - i.e., why would you want to "fix" it?

Cheers
ZB

The applications (binary) are running fine as expected (it should not make difference whether it is a background process or a Unix Deamon). And all the necessary/required I/O with respect to applications are occurring fine with out any issues.

So, in this case, one would expect that 'ps' command with right options should list this process & its current status!!

It sounds like all this was working fine until few days back, and suddenly he is
seeing that "PS" is not listing the desired process, while the desired process is still running properly.
ps -ef not listing all the running demons so we thought some issue with proc

First ask the user what he has changed, then make sure you can duplicate the problem in a separate privileged environment. There's a BIG chance something changed in the environment.

Don't assume /proc is messed up right of the bat.

does ps -ef list anything? or does it hang?

HI,
ps -ef lists all the demons running but only not listing few. Any how I found the reason why its not listing because ps command owner and group changed to normal user instead of root. I don't know how ps command owner and group changed to normal user?

Thanks a lot
Bache Gowda

Do "normal" users own other executables (in the /bin, /sbin, /usr/bin and /usr/sbin directories)? Sometimes you'll see executables owned by "bin" - this is normal. If a true "normal" user owns these files, chances are you've been compromised!

Does anybody other than yourself know the root password? Have you noticed lots of failed ssh connections, etc? Check your logs (/var/log/messages) and see if anything naughty is going on. Good luck.

If you've been compromised, you're only real option is to restore trusted executables - whether this be from installation media/backups depends upon your disaster recovery procedures.

And all of this assumes that you actually have been compromised. And remember, a great deal of compromises come from somebody inside organisations

Cheers
ZB