rkhunter/cron.daily: broken pipe & deleted files

Kalimari · Unread post by **Kalimari** » Tue Aug 12, 2008 7:48 pm

I've had a small problem since updating RHEL4 box to Nahant 7. /etc/cron.daily/01-rkhunter gives the following error x10 + when run:

Code: Select all

grep: writing output: Broken pipe

There are no further clues in: /var/log/rkhunter.log, have Google'd long and hard with only a few similar matches, one from this forum dated 2004, but no solution.

Also, rkhunter Daily Run itself gives the following (with a dozen or so different PID's):

Code: Select all

Warning: The following processes are using deleted files:
Process: /usr/sbin/httpd    PID: 2444    File: /tmp/eaccelerator.apache2handler2444.sem.yLjfCS

Has anyone encountered these problems before, have any suggestions or a possible solution?

Thanks!

Unread post by **scott** » Tue Aug 12, 2008 8:38 pm

Might be good to start with the version

Kalimari · Unread post by **Kalimari** » Wed Aug 13, 2008 2:50 am

Red Hat Enterprise Linux ES release 4 (Nahant Update 7)
Rootkit Hunter version 1.3.2
crontabs 1.10-7
eAccelerator 0.9.5.3
httpd 2.0.52-41.ent
grep 2.5.1-32.3
Plesk 8.4

Any other version info required?

Unread post by **scott** » Wed Aug 13, 2008 8:52 am

yeah, check with rpm -q rkhunter

Kalimari · Unread post by **Kalimari** » Wed Aug 13, 2008 8:54 am

rkhunter-1.3.2-8.el4.art

Kalimari · Unread post by **Kalimari** » Thu Aug 14, 2008 1:21 pm

scott wrote:Might be good to start with the version
yeah, check with rpm -q rkhunter

Kalimari wrote:rkhunter-1.3.2-8.el4.art

rkhunter --debug --cronjob --nocolors --report-warnings-only gave lots of output (/tmp/rkhunter-debug) but nothing related and am unable to replicate the error outside daily.cron.

I can live with broken pipes and processes using deleted files as rkhunter is running OK otherwise, could do without the 2 extra e-mails per day and the niggle that something ain't right.