From owner-freebsd-questions@FreeBSD.ORG  Sat Dec 18 17:19:42 2004
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 85FED16A4CE
	for <freebsd-questions@freebsd.org>;
	Sat, 18 Dec 2004 17:19:42 +0000 (GMT)
Received: from sierra.rtfm.com (sierra.rtfm.com [198.144.203.251])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4C2DD43D1F
	for <freebsd-questions@freebsd.org>;
	Sat, 18 Dec 2004 17:19:42 +0000 (GMT)	(envelope-from ekr@rtfm.com)
Received: from rtfm.com (romeo.rtfm.com [198.144.203.242])
	by sierra.rtfm.com (Postfix) with ESMTP id 3D64F71D2
	for <freebsd-questions@freebsd.org>;
	Sat, 18 Dec 2004 09:42:38 -0800 (PST)
To: freebsd-questions@freebsd.org
In-reply-to: Your message of "Sat, 18 Dec 2004 09:06:29 PST."
X-Mailer: MH-E 7.4.3; nmh 1.0.4; XEmacs 21.4 (patch 15)
Date: Sat, 18 Dec 2004 09:19:40 -0800
From: Eric Rescorla <ekr@rtfm.com>
Message-Id: <20041218174238.3D64F71D2@sierra.rtfm.com>
Subject: Re: Missing /etc/periodic.daily processes in /proc 
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>,
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 18 Dec 2004 17:19:42 -0000

Eric Rescorla <ekr@rtfm.com> wrote:
> FreeBSD Version:	FreeBSD 4.9-STABLE #2
> Platform:		x86
> 
> I recently ran chkrootkit and it complained about processes that were in
> ps but not in /proc. Usually these are just transient processed but in
> this case I investigated and found something weird.
Oh, one more thing:
The files actually exist in /proc and look to be populated with
reasonable stuff. E.g.

[65] ls /proc/11253
cmdline ctl     dbregs  etype   file    fpregs  map     mem     note    notepg  regs    rlimit  status

-Ekr