[ossec-dev] [Bug 93] New: Rootcheck false positive

[ossec-bugzilla@xxxxxxxxxxxxxxxxxxxxxxxxxxx]

http://www.ossec.net/bugs/show_bug.cgi?id=93

           Summary: Rootcheck false positive
           Product: OSSEC
           Version: 1.3
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P1
         Component: rootkit-detection
        AssignedTo: ossec-dev@xxxxxxxxx
        ReportedBy: bert@xxxxxxxxxxxx


I received this event and I believe it's a false positive. Please check.

Received From: (xxx) xxx.xxx.xxx.xxx->rootcheck
Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)."
Portion of the log(s):

Files hidden inside directory '/sys/class/vc'. Link count does not match number
of files (54,34).

greets,

Bert


-- 
Configure bugmail: http://www.ossec.net/bugs/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.