[prev in list] [next in list] [prev in thread] [next in thread] 

List:       chkrootkit-users
Subject:    [crt-users] crontab and chkrootkit
From:       "Mike Vanecek" <ckroot_list () mm-vanecek ! cc>
Date:       2003-08-06 1:52:25
[Download RAW message or body]

My /etc/crontab has the following entry

# check for rootkits daily and mail results to root
0 3 * * * root cd /usr/sbin; ./chkrootkit -q 2>&1 | mail -s "chkrootkit
output" root

Up until a couple of days ago, it ran just like it should. The message I
receive contains:

/usr/lib/perl5/5.8.0/i386-linux-thread-multi/.packlist
/usr/lib/perl5/5.8.0/i386-linux-thread-multi/auto/CPAN/.packlist 
[snip]
/usr/lib/openoffice/share/kde/net/applnk/OpenOffice.org/.directory
/usr/lib/openoffice/share/kde/net/applnk/OpenOffice.org/.order

/usr/bin/find: //proc/16144/fd: No such file or directory
/usr/bin/find: //proc/16144/fd: No such file or directory 

The last two messages are a new happening. However, if I run the same string
of commands from a command line, it runs just fine and does NOT have the two
line errors. None of the other items in crontab have any errors (complete
crontab follows). The error does not show up in any of my system logs.

I am at a loss at to where to look next.

Any ideas?

My complete crontab looks like:

[root@www sbin]# cat /etc/crontab
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/
 
# field          allowed values
#              -----          --------------
#              minute         0-59
#              hour           0-23
#              day of month   1-31
#              month          1-12 (or names, see below)
#              day of week    0-7 (0 or 7 is Sun, or use names)
#
  
# run-parts
01 * * * * root run-parts /etc/cron.hourly
02 4 * * * root run-parts /etc/cron.daily
22 4 * * 0 root run-parts /etc/cron.weekly
# 42 4 1 * * root run-parts /etc/cron.monthly
30 3 1 * * root run-parts /etc/cron.monthly
 
# check for rootkits daily and mail results to root
0 3 * * * root cd /usr/sbin; ./chkrootkit -q 2>&1 | mail -s "chkrootkit
output" root
 
# check for tripwire reports files and delete old ones
40 4 * * * root find  /var/lib/tripwire/report -daystart -type f -mtime -90
-mtime +29 | xargs -r rm
 
# run wormscan daily and mail results to root
20 3 * * * root cd /usr/local/worm; ./run_worm -q 2>&1 | mail -s "wormscan
output" root
 
# run the logck program daily and mail results to root
50 23 * * * root /usr/local/bin/logck 2>&1 | mail -s "logck output" root
 

[prev in list] [next in list] [prev in thread] [next in thread]