[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: tiger: howto manage flood of `deleted files' alerts ???



Javier Fernández-Sanguino Peña <jfs@computer.org> [2004:01:07:18:52:45+0100] scribed:
> On Mon, Jan 05, 2004 at 01:04:18AM -0600, Michael D Schleif wrote:
> > I have been using tiger for nearly a year.  Several months ago, a new
> > test was added in:
> > 
> >    /usr/lib/tiger/scripts/check_finddeleted
> 
> I wrote this (probably too agressive test) after reading one of Brain 
> Hatch's excellent articles [1]. It's probably written in a very broad way 
> (to catch all the culprits) but fires off in many common cases.
> 
> Since Tiger 3.2.1 provides an "ignore" mechanism (similar to logcheck's) 
> you can add those common cases to your tiger.ignore file. In bug # 225112
> I mention some common ones (in my case) which include the following regular 
> expressions (for apache):

Yes, I use several ignore regexps -- I had hoped that there is some
configuration option that I missed.

> Server /usr/sbin/apache \(pid \d+\) is using deleted files
> The parent process of server /usr/sbin/apache \(pid \d+\) is using deleted files
> Program apache \(pid \d+, parent \d+\) is using a deleted file: .* /tmp/session_mm_apache0.sem \(deleted\)
<snip />

Yes, I found these helpful.  However, `\d' does *NOT* work on my system;
rather, I had to change these to `[0-9]' -- and, yes, I did debug these
with egrep, with same result.

Thank you.

-- 
Best Regards,

mds
mds resource
877.596.8237
-
Dare to fix things before they break . . .
-
Our capacity for understanding is inversely proportional to how much
we think we know.  The more I know, the more I know I don't know . . .
--

Attachment: pgpyCceEzn5AV.pgp
Description: PGP signature


Reply to: