Re: [Rkhunter-users] [1]+ Stopped /usr/local/bin/rkhunter

[John H. <joh...@pl...>]

On Sun, 2009-08-09 at 13:45 +1000, Brenton Taylor wrote:
> John Horne wrote:
> > On Sat, 2009-08-08 at 00:21 +1000, Brenton Taylor wrote:
> >> Mike McCarty wrote:
> >>> Brenton Taylor wrote:
> >>>  
> >>>> Hello,
> >>>>      Every time I run rkhunter I get a message that says something like:
> >>>>
> >>>>      [1]+  Stopped                 /usr/local/bin/rkhunter
> >>>>
> >>>>      and when I run rkhunter --check  it get up to [Press <ENTER> to 
> >>>> continue] and I press the Enter key and it doesn't complete the 
> >>>> scanning and the process is still alive until I type skill rkhunter.
> >>>>     
> >>> Have you tried "fg"?
> >>>   
> >> I have tried fg . I just did it again to see what the output was:
> >>
> >> [Press <ENTER> to continue]
> >>
> > You can use the '--sk' option to rkhunter to avoid the 'press enter to
> > continue' messages. (See the 'man rkhunter' page).
> >
> Thanks John, I didn't think to check for that option in the man pages. 
> I'm pretty happy that it runs all the checks now.
> 
> The "[1]+ Stopped" still comes near the beginning of the tests, its a 
> bit annoying. After the summary is displayed I press Enter then "[1]+ 
> Exit 1" comes up and I'm back to prompt. I think the tests ran properly 
> and rkhunter process stopped properly at the end, its just those 2 
> messages now. Also if I try doing Ctrl + C after the "[1]+ Stopped" I 
> can't stop the process unless I open another terminal and type skill 
> rkhunter twice.
> 
I really don't think the '[1]+ stopped' type messages are anything to do
with rkhunter (RKH) itself. I can't think of anything within rkhunter
which would do this (or even how!). As has already been mentioned it
seems like something else is causing RKH to be stopped.

However, if you want to you can run 'rkhunter --debug -c --sk' and this
will cause a debug file to be created in /tmp. You can send the file to
me and I'll take a look to see if there is anything obvious.

Not sure why you use the 'skill' command - I admit I hadn't heard of it
and had to look it up. On my Fedora 11 system the man page states for
skill (the 'tools' being skill and snice):

   These tools are probably obsolete and unportable. The command syntax
   is poorly defined. Consider using the killall, pkill, and pgrep com-
   mands instead.

As it suggests look at pkill or just the 'kill' command instead. It may
save you problems on systems which no longer support skill.



John.

-- 
---------------------------------------------------------------
John Horne, University of Plymouth, UK  Tel: +44 (0)1752 587287
E-mail: Joh...@pl...       Fax: +44 (0)1752 587001