Tom Horsley wrote: > On Wed, 24 Oct 2007 08:53:01 +0800 > Ed Greshko <Ed.Greshko@xxxxxxxxxxx> wrote: > >> It is sealert...but it will show up truncated in top. >> >> It should be in /usr/bin. If you can't find it there...then use locate. > > I used an even bigger hammer, and find / -name 'sealer*' does not > find a match anywhere on the system. > > Clearly something is being execed with argv[0] == /usr/bin/sealer, > but I don't know what it is (and it doesn't hang around long enough > to poke in the /proc files for it :-). Do you have setroubleshoot installed?
