I&#39;ve got a watch looking at /dev/mem<div><br></div><div>  auditctl -w /dev/mem -k kernel -p wa</div><div><br></div><div>which I understand means that auditd is looking for writes or attribute changes to /dev/mem (according to the manpage for auditctl)</div>

<div><br></div><div>The weird thing is that auditd seems to be flagging calls to fstat, and I&#39;m not sure why auditd would be doing this since.</div><div><br></div><div><pre>2011-11-30T14:02:42.624523-08:00 node/x.x.x.x audispd: node=node type=PATH msg=audit(1322690562.613:38): item=0 name=&quot;/dev/mem&quot; inode=1358 dev=00:05 mode=020640 ouid=0 ogid=15 rdev=01:01
<br></pre><pre>2011-11-30T14:02:42.624494-08:00 node/x.x.x.x audispd: node=node type=CWD msg=audit(1322690562.613:38):  cwd=&quot;/&quot;
<br></pre><pre>2011-11-30T14:02:42.624480-08:00 node/x.x.x.x audispd: node=node type=SYSCALL msg=audit(1322690562.613:38): arch=40000003 syscall=5 per=400000 success=yes exit=3 a0=8048f6c a1=2 a2=180 a3=0 items=1 ppid=4132 pid=4199 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=&quot;IrqRouteTbl&quot; exe=&quot;/opt/hp/hp-health/bin/IrqRouteTbl&quot; key=&quot;kernel&quot;</pre>

</div><div><br></div><div>running kernel 2.6.38.8 on ubuntu with auditd version 1.7.13-1ubuntu2.</div><div><br></div><div>Cheers,</div><div>peter</div>