Which process creating cracker files?

Question

A large number of cracker files with name FOO** are created by some of the process. I executed following command to found culprit process lsof -f -F /tmp/*

But didn't found anything useful.

Is there any better way to catch culprit process.

Out of curiousity, what do you mean by "cracker files" anyway? — DictatorBob, Apr 26 '11 at 19:29

score 1 · Answer 1 · answered Apr 26 '11 at 10:16

1

You'll want to use the audit subsystem to track down the rogue process.

answered Apr 26 '11 at 10:16

Ignacio Vazquez-Abrams

45,939
6
79
84

I can't use audit subsystem. Any alternate idea ? – vnix27 Apr 26 '11 at 11:30

score 0 · Accepted Answer · answered Apr 26 '11 at 13:24

lsof |grep FOO # should give a listing of processes that are creating at that time files with the name FOO

if there is not output from this you may need to setup a cronjob do list every minute - I'm thinking perhaps the process is not running all the time. if nothing comes up from this look when the files were created

stat FOO

look at the owner/permissions/modification time etc. and see if something may tell you something

Which process creating cracker files?

2 Answers2