On 11.10.2015 21:18, Theo de Raadt wrote:
I rebuild who(1) with DEBUG and add 'abort' in all pledge calls.
Also I changed kern.nosuidcoredump=3 and made /var/crash/who but I
can't
find who.core.
Meanwhile I got syscall 54 every 5 min. Is it possible another
process/daemon to generate this errors?
How can I find it?
~$ tail /var/log/messages
Oct 11 19:54:37 ns /bsd: who(5929): syscall 54
Oct 11 19:59:37 ns /bsd: who(6769): syscall 54
Oct 11 20:04:37 ns /bsd: who(13907): syscall 54
Oct 11 20:09:37 ns /bsd: who(27822): syscall 54
Oct 11 20:14:37 ns /bsd: who(25574): syscall 54
Oct 11 20:19:37 ns /bsd: who(8480): syscall 54
Oct 11 20:24:37 ns /bsd: who(28849): syscall 54
Oct 11 20:29:37 ns /bsd: who(11423): syscall 54
Oct 11 20:34:37 ns /bsd: who(20946): syscall 54
I have no explanation for this. You'll have to keep digging to find
it.
I think that I found it - Nagios. Now the question is how to debug it
further?
