From owner-freebsd-security Tue Nov 3 06:45:05 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id GAA16517 for freebsd-security-outgoing; Tue, 3 Nov 1998 06:45:05 -0800 (PST) (envelope-from owner-freebsd-security@FreeBSD.ORG) Received: from gjp.erols.com (alex-va-n008c079.moon.jic.com [206.156.18.89]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id GAA16507 for ; Tue, 3 Nov 1998 06:45:03 -0800 (PST) (envelope-from gjp@gjp.erols.com) Received: from gjp.erols.com (gjp@localhost.erols.com [127.0.0.1]) by gjp.erols.com (8.9.1/8.8.7) with ESMTP id JAA11634; Tue, 3 Nov 1998 09:44:37 -0500 (EST) (envelope-from gjp@gjp.erols.com) X-Mailer: exmh version 2.0.1 12/23/97 To: Jay Nelson cc: security@FreeBSD.ORG From: "Gary Palmer" Subject: Re: hidden files question In-reply-to: Your message of "Mon, 02 Nov 1998 22:56:24 CST." Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Date: Tue, 03 Nov 1998 09:44:37 -0500 Message-ID: <11630.910104277@gjp.erols.com> Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org Jay Nelson wrote in message ID : > Is there a known benign condition that could account for this? Try running fstat & friends to see if there is a file held open on /var. Its possible that a program opened up a file and it somehow got unlinked (a nightly tidy-up cron?) but the file is still held open. So its not visable via any directory, but its still there. Gary -- Gary Palmer FreeBSD Core Team Member FreeBSD: Turning PC's into workstations. See http://www.FreeBSD.ORG/ for info To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message