strange command in terminal

[ewg]

Any idea why this command would appear in my terminal? What does it do? I did not enter it.

sudo fuser -v /dev/dsp* /dev/snd/* /dev/seq*

Thanks,

[elija]

Have you installed anything or run any scripts recently?

Are you the only person who uses this PC?

[ewg]

I'm the only user. The only thing I have added is the routine updates to Ubuntu 9.10

Thanks,

[reed9]

fuser is used to show whether a file is being used by process.

For example

reed@reed-desktop ~ % fuser -v /home/reed
                     USER        PID ACCESS COMMAND
/home/reed:          reed       3841 ..c.. transmission-da
                     reed       3852 ..c.. zsh
                     reed       3874 ..c.. startx
                     reed       3891 ..c.. xinit
                     reed       3895 ..c.. ck-launch-sessi
                     reed       3968 ..c.. openbox
                     reed       3977 ..c.. openbox-session
                     reed       3981 ..c.. lxpanel
                     reed      28585 ..c.. zsh

And we can see the various processes accessing my home directory.

It can also be used to kill a process accessing the file, with the -k flag. Useful if you have a rogue process preventing you from closing a file.

/dev/dsp would be digital sampling and recording devices.
/dev/snd are sound devices
/dev/seq would presumably be sequencing devices, but I think those should be in /dev/snd/seq

So if someone was cracking your system, they apparently were looking for any open processes accessing your sound devices.

[ewg]

Interesting. It appeared during last 'updates'. Could something in those updates trigger it?

[reed9]

It seems unlikely, and certainly not with 'sudo'. Updates would have already been given elevated privileges by you.

Sudo logs everything, though. Look in /var/log/auth.log

View log files in Ubuntu Linux

[ewg]

Found the log. Not sure what I'm looking for though. Suggestion?

Thank you,

[reed9]

Look around the date and time you think this occurred. The log will show you the command run.

Example

Jan 22 02:42:58 reed-desktop sudo:     reed : TTY=pts/1 ; PWD=/home/reed ; USER=root ; COMMAND=/usr/bin/nano /etc/X11/xorg.cconf

If they failed to enter the password correctly, it will show. If there were failed remote login attempts, it will show.