LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 05-18-2010, 01:36 AM   #1
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,627

Rep: Reputation: Disabled
Dansguardian binary file in /usr/local/sbin dies out from time to time?


Hello all,

There is this server running squid and dansguardian as proxy for the local network. Everything is working fine. But I have seen that from time to time the danguardian dies out and fails to respond to shutdown or restart commands. And this is because of the binary located at /usr/local/sbin named dansguardian goes empty. There are multiple instances and hence copying another named dansguardian.2 to dansguardian does it. And dansguardian works normally as it should.
Looked into dmesg and /var/log/messages but nothing there.
Any point I should be looking at?

PS: It was compiled and not installed from pre compiled binaries. And runs on CentOS5.4 Final.
 
Old 05-19-2010, 02:29 PM   #2
rweaver
Senior Member
 
Registered: Dec 2008
Location: Louisville, OH
Distribution: Debian, CentOS, Slackware, RHEL, Gentoo
Posts: 1,833

Rep: Reputation: 163Reputation: 163
When you say dies out you mean is zero'd out? (0 bytes?) is it possible you have a cron job doing it accidentally or an ids? What about login attempts and have you run chkrootkit and rkhunter?
 
Old 05-20-2010, 12:07 AM   #3
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,627

Original Poster
Rep: Reputation: Disabled
Yes zero bytes. The file is empty. But there is no way to tell when this will happen. Just happens. I doubt any cron job. I do not have any such jobs. I have not found any brute login attempts via ssh. Telnet service anyhow is never started. Will check out for rootkits. But I still doubt it.
 
Old 05-21-2010, 02:01 AM   #4
linuxlover.chaitanya
Senior Member
 
Registered: Apr 2008
Location: Nagpur, India
Distribution: Cent OS 5/6, Ubuntu Server 10.04
Posts: 4,627

Original Poster
Rep: Reputation: Disabled
Checked the server for the rootkits with rkunter and chkroot and none of them found anything. So I assume that there are no rootkits.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Date Time ACL in squid for Local time thetzawko Linux - Server 1 10-20-2009 06:58 PM
Timzone Issues...Local Time versus UTC time? as400 Solaris / OpenSolaris 12 09-26-2008 12:40 PM
bash: /usr/local/bin/CMIX: cannot execute binary file orenmagid Linux - Software 1 07-18-2007 03:16 PM
making files available in /usr/local/bin and /usr/sbin reakinator Linux - Newbie 1 10-14-2006 05:09 PM
Starting httpd: /usr/sbin/httpd: symbol lookup error: /usr/local/lib/libaprutil-0.so. bijuhpd Linux - Newbie 1 10-30-2005 05:07 PM


All times are GMT -5. The time now is 12:27 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration