Am 30.06.2012 10:02, schrieb Frank Murphy:
Warning: The syslog daemon is not running.
Warning: Suspicious file types found in /dev:
/dev/md/autorebuild.pid: ASCII text
/dev/shm/sem.lastpassffsemaphore: data
cat /dev/md/autorebuild.pid
708
yum whatprovides */autorebuild.pid
give no matches.
Google gives mdadm as possible culprit
mdadm is installed, no raid on that box.
[root@srv-rhsoft:~]$ cat /etc/rkhunter.conf.local | grep autor
ALLOWDEVFILE=/dev/md/autorebuild.pid
too few packagers are using rkhunter
such false positives happens often after updates