The acctadm command is used to configure extenede process accouting. Without any arguments, it outputs the current state of accounting on the system: bash 3.00# acctadm ...
To create a storage pool zpool create Verify that the pool was created: zpool list To create a mirror of the storage pool on another disk: zpool create pool name ...
EnyeLKM is a loadable kernel module virus that inserts jumps in both the system call and sys enter functions to massage output. I did some research on the specifics ...
This process list was taken from a default install of Solaris 9 on an x86 VM and represents a pretty standard default process list. The root user is logged in at the ...
Solaris Process: /usr/lib/ssh/sshd: The Secure Shell (SSH) server daemon. Notice the path (runs from /usr/lib/ssh). This path is normal for Solaris. Configuration ...
Solaris Process: /usr/lib/sendmail: Handles accepting and delivery of mail using SMTP. Notice the path (running out of /usr/lib). This looks abnormal to Linux users ...
Solaris Process: /usr/sbin/vold: Creates and manages file systems for cdrom and floppy drives, normally in /vol. Configuration file: /etc/vold.conf JakeWilliams ...
Solaris Process: /usr/lib/dmi/snmpXdmid: The snmpXdmid process is the Sun Solstice Enterprise SNMP DMI mapper subagent. It maps SNMP requests to DMI requests. Configuration ...
Solaris Process: /usr/lib/dmi/dmispd: The dmispd process is Sun Solstice Enterprise DMI (Desktop Management Interface) Service Provider. Configuration file: /etc ...
Solaris Process: mibiisa: Sun's SNMP agent. The r option places the MIB in read only mode. The p option specifies the UDP port to listen on. Configuration file: ...
Solaris Process: /usr/lib/snmp/snmpdx: The snmpdx process is the Sun Solstice Enterprise Master Agent. Listens on udp/161 and other ports as needed to receive trap ...
Solaris Processes: smcboot: Part of the Solaris Web Based Enterprise Management (WBEM) system, specifically the Solaris Management Console. Used more in Solaris 10 ...
Solaris Process: utmpd: Monitors the /var/adm/utmpx file as well as /proc to detect process termination. It updates the file as needed (when processes exit). JakeWilliams ...
Solaris Process: powerd: Powerd controls system activity using the suspend/resume feature of Solaris. Started by pmconfig (which then usually exits) in /etc/init.d ...
Solaris Process: nscd: Name Services Cache Daemon. It provides caching for passwd, group, hosts, ipnodes, exec attr, proc attr, and user attr. Default configuration ...
Solaris Process: statd: The statd process is part of the NFS system in Solaris. On the server side it advises clients with file locks when the server they hold the ...
Solaris Process: /usr/sbin/cron: Runs scheduled jobs for the system. Note that this is simply "cron" as opposed to "crond" in Linux. Another difference from Linux ...
Solaris Process: automountd: An RPC server that handles requests to mount and unmount file systems as part of autofs. It is automatically invoked in runlevel 2. ...
Solaris Process: /usr/lib/nfs/lockd: The lockd process is a component of the NSF file locking manager. It is started via /etc/init.d/nfs.client but configured via ...
Solaris Process: inetd: The inetd process handles listening for standard network services and spawning the appropriate daemon upon connection. It reads /etc/inet/inetd ...
Solaris Process: rpcbind: The rpcbind proces converts RPC program numbers into the universal addresses used on that machine. It must be running for the host to be ...
Solaris Process: in.routed: This is the Solaris routing daemon and handles the routing tables for the Solaris OS. It is configured by files /etc/defaultrouter, /etc ...
Solaris Process: picld: PICL (Platform Information and Control Library) daemon. This daemon aids in hardware abstraction by allowing the kernel to publish platform ...
Solaris Process: syseventd: Syseventd is a daemon that allows passing of kernel level messages to userspace where all interested subscribers will be delivered the ...
Solaris Process: ttymon: This can be thought of as similar to the mingetty processes configured in /etc/inittab in Linux in that it handles the connection parameters ...
Solaris Process: /usr/lib/saf/sac: The SAC process is the Service Access Controller. It handles all requests from the system to start and stop port monitors on the ...
Solaris Process: fsflush: This is a required system process. It flushes dirty file system pages to disk, pages dirty memory back to disk, and writes file system metadata ...
Solaris Process: pageout: The pageout process is required on a functional Solairs system and is used to control the paging of virtual memory to disk and back to memory ...
Solaris Process: init: This shows up in Solaris 9 x86 as '/etc/init '. Don't know for sure what the hyphen is for in this case. /etc/init is just a symlink to /sbin ...
Solaris Process: sched: Used to be known as the swapper process. It is exactly what it sounds like, the scheduler process. Linux implements this as a kernel thread ...
I've been working with some Rootkit code in Linux recently. This will be the top level topic for communicating about Linux/Unix rootkits. Each variety will get its ...
One of the key things to look at when investigating a filesystem for forensic activity in Linux are the MAC (modify, access, and change) times on the system. Modify ...
My stupid simple steps to compiling: make gconfig (or menuconfig if you don't have GNOME) make make modules make modules install make install cd /boot Fix grub so ...
These reside in /var/lib/rpm on my Fedora 9 machine: Packages: There is one entry for each rpm on the machine. The first entry is a dud, both the key and data report ...
Programming Kernel Modules: Module basics: Every module needs to have an init function an exit function. They are registered using mdule init() and module exit() respectively ...
This topic is in place to cover what I know about rpm programming. I had to build some RPM packages in the past, but that involved building a SPEC file. I want to ...
You can walk all records in a database using a cursor. On the first c get, specify the cursor position flag DB FIRST. On each subsequent get (until you reach the end ...