Originally posted by: kykwon

Dear all

i have an aix6.1 on P770 server.

and there is a file which is /dev/null 2>&1 on the server.

eg) #>ls -l /dev/nu*
crw-rw-rw-    1 root     system        2,  2 Apr 26 09:53 /dev/null
-rw-r--r--    1 root     system        32156 Apr 26 09:53 /dev/null 2>&1
-rw-r--r--    1 root     system          105 Mar 22 2013  /dev/nulll
crw-rw-rw-    1 root     system       18, 34 Sep 03 2012  /dev/nuls

i removed the file. but the file was created automatically. and size of the file is increasing more and more.

What can i do? and what is the file?

Originally posted by: luverofpeanuts

My first guess is that  it seems that some process is inadvertently creating a filed named "/dev/null 2>&1"   instead of doing actual file redirection that it probably intends to do. 

I think you are going to have to do a "lsof | grep null" on the file to see if you can catch which PID is doing it.   

Also, check crontab   ... i.e. "crontab -l"   to see if any commands in there are redirecting wrong and causing.   

Having you looked at what is in the file?  That might provide a clue too.   

Originally posted by: PetePDX

Already mentioned check out root's crontab

See if you can find what is writing to the file lsof, etc

Change the perm on the file to read only and see who complains

Are you running audit ? If so time to learn the ins and outs of audit, go find who created it in the first place

What are the contents of the file ? If not clean text, do a strings on it. The contents can help you get an Idea of what is doing the writing

BTW you have another file (not character device) called /dev/null March 22'd. Do a last and find out who with root access was on then.

Get that person yourself and manager(s) in to a room and discuss your companies termination policy for that person and his manager.

Originally posted by: AncientAIXer

Isn't that a little harsh for a couple of possible typos?

Originally posted by: kykwon

Hi luverofpeanuts and PetePDX

first of all, Thank you for reply

I will try to lsof and check crontab file.

and I did not run audit.

Originally posted by: kykwon

Dear all

i solved the problem with below link

http://www-01.ibm.com/support/docview.wss?uid=nas74d33539b559cc0308625792900533a8f

thank you.