Re: [PLUG] Booting/disk "problem"?

[sean finney <seanius@seanius.net>]

On Wed, Aug 18, 2004 at 04:43:28PM -0400, eric@lucii.org wrote:
>      On the p6 partition, the is only: /bin, /boot, /home, /proc,
>      /usr and /var Since boot, home, usr, and var are mount points, they
>      are empty.  There are a number of files in the bin directory
>      including one called "all.tar" which is 122 MB and is truncated.
>      The tar file was created about the last time that the machine was
>      known to be working.  

can anyone attest to the origin of the all.tar?  how about anything
interesting in the logs, or perhaps truncated logs in /var?  is there
a loghost? can you get a table of contents from the tar file?  
process accounting?  if there's anything that will help you, it'll
probably be in that /var partition.

perhaps i'm a bit too paranoid, but my first assumption in a case like
this is usually that the machine is hacked.  it doesn't help much
that it was running redhat 8...


	sean

Attachment: signature.asc
Description: Digital signature