From owner-freebsd-questions@FreeBSD.ORG Thu Nov 24 09:05:34 2011 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id F190D1065672 for ; Thu, 24 Nov 2011 09:05:34 +0000 (UTC) (envelope-from odhiambo@gmail.com) Received: from mail-gy0-f182.google.com (mail-gy0-f182.google.com [209.85.160.182]) by mx1.freebsd.org (Postfix) with ESMTP id AE0C38FC0C for ; Thu, 24 Nov 2011 09:05:34 +0000 (UTC) Received: by ghbg20 with SMTP id g20so2057337ghb.13 for ; Thu, 24 Nov 2011 01:05:34 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=dNmiJOF1s1JO/4kU4QktD/OVqRQHVUgDic6gpjbUf20=; b=gXPX8lQtjWjHTIdcuh/gqE45Bieh+31aQ/TntTSg7Ww3+D9JD+Msdr1cAY3wi/UaST DbmJvb9b942s1NKVmvjNMsi9YVUYgCBgkVfcDpcsXMLJJWKQYRGjNDciywmLt1cBWyTx GW3Bcf/Tsqj7XxtZD6Dj4vAkmzKoJckl/3pEs= Received: by 10.14.14.210 with SMTP id d58mr1689261eed.22.1322125533208; Thu, 24 Nov 2011 01:05:33 -0800 (PST) MIME-Version: 1.0 Received: by 10.213.22.78 with HTTP; Thu, 24 Nov 2011 01:04:52 -0800 (PST) In-Reply-To: References: From: Odhiambo Washington Date: Thu, 24 Nov 2011 12:04:52 +0300 Message-ID: To: Ross Content-Type: multipart/related; boundary=0016e658614ec1602804b27756d9 X-Content-Filtered-By: Mailman/MimeDel 2.1.5 Cc: freebsd-questions@freebsd.org Subject: Re: Do you run OSSEC on 9.0? X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 24 Nov 2011 09:05:35 -0000 --0016e658614ec1602804b27756d9 Content-Type: text/plain; charset=UTF-8 Getting the same too, since I upgraded my 8.2 -> 9.0-PRE. Would be interested in the answers too. On Thu, Nov 24, 2011 at 10:32, Ross wrote: > I am getting emails about hidden files in /dev. Before that (on 8.2) > everything was OK. What should I do? > > > OSSEC HIDS Notification. > 2011 Nov 24 08:17:25 > > Received From: coffin->rootcheck > Rule: 510 fired (level 7) -> "Host-based anomaly detection event > (rootcheck)." > Portion of the log(s): > > Files hidden inside directory '/dev'. Link count does not match number > of files (9,27). > > > > --END OF NOTIFICATION > _______________________________________________ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to " > freebsd-questions-unsubscribe@freebsd.org" > -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254733744121/+254722743223 _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ I can't hear you -- I'm using the scrambler. Please consider the environment before printing this email. --0016e658614ec1602804b27756d9--