From 1c9b59fa7f59cc027d09494102977063c6330d88 Mon Sep 17 00:00:00 2001 From: Sebastian Harl Date: Sun, 7 Oct 2007 15:01:50 +0200 Subject: [PATCH] README: Added a note about collectd and chkrootkit. chkrootkit reports collectd as a packet sniffer, which most probably is a false positive if using the "dns" plugin. Signed-off-by: Sebastian Harl Signed-off-by: Florian Forster --- README | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/README b/README index 57ae4550..f1d78600 100644 --- a/README +++ b/README @@ -236,6 +236,17 @@ Operation the values and read the rrdtool(1) manpage thoroughly. +collectd and chkrootkit +----------------------- + + If you are using the `dns' plugin chkrootkit(1) will report collectd as a + packet sniffer (": PACKET SNIFFER(/usr/sbin/collectd[])"). The + plugin captures all UDP packets on port 53 to analyze the DNS traffic. In + this case, collectd is a legitimate sniffer and the report should be + considered to be a false positive. However, you might want to check that + this really is collectd and not some other, illegitimate sniffer. + + Prerequisites ------------- -- 2.30.2