Linux with Operating System Concepts

459
TABLE 11.3 
Linux Services
Name
Type
Description
acpi
Power management Laptop battery fan monitor
acpid
Event handling
Handles acpi events
anacron
Scheduling
For scheduling startup tasks at initialization time
apmd
Power management Laptop power management
arpwatch
Web/Internet
Logs remote IP addresses with hostnames
atd
Scheduling
Executes at jobs based on a scheduled time and batch 
jobs-based CPU load
auditd
Logging
The Linux auditing system daemon that logs system, software, 
and user-generated events
autofs
File system
Automatically mounts file systems at initialization
bluetooth
Hardware
Bluetooth service
certmonger
Web/Internet
Maintain up-to-date security certificates
cpufreq, cpufreqd
Hardware
Configures and scales CPU frequency to reduce possible CPU 
overheating
crond
Scheduling
The daemon for handling cronttab jobs
cups
Hardware
Service for printing
cvs
System
Managing multiuser documents
dhcpd
Web/Internet
Configure DHCP access
dnsmasq
Web/Internet
Starts/stops DNS caching
gpm
Hardware
Mouse driver
haldaemon
Hardware
Monitors for new or removed hardware
httpd
Web/Internet
The Apache web server
iptables, ip6tables
Web/Internet
The Linux firewalls
mdadm
File system
Manages software for RAID
named
Web/Internet
Starts/stops the BIND program (DNS)
netfs
File system
Allows remote mounting
netplugd
Network
Monitors network interface
network
Network
Starts and stops network access
nfs
File system
Enables network file system sharing
nscd
Network
Password and group lookup service
oddjobd
System
Fields requests from software that otherwise do not have 
access to needed Linux operations
postfix
Network
Mail service
prelude
Network
Intrusion detection system service
rdisc
Network
Discovers routers on local subnet
rsync
File system
Allows remote mounting of file systems
smartd
Hardware
Monitors SMART devices, particularly hard drives
snmpd
Network
Network management protocol for small networks
sshd
Network
Service to permit ssh access
syslog
Logging
System logging
ypbind
Network
Name server for NIS/YP networks

---

460
◾
Linux with Operating System Concepts
logging operations by placing information in a database or log file. In addition, plugins 
can be used to provide more specific types of actions such as invoking a debugger or 
sending a crash report by email to a prespecified email address. By default, logging 
information is filed in the /
var/spool/abrt
directory. The abrtd daemon calls 
upon subservices for added functionality such as 
abrt-gui
which displays logged 
information graphically and 
abrt-cli
which provides similar information via the 
command line, or 
abrt-applet
which, as its name implies, is an applet that can 
provide real-time feedback of software crashes.
• anacron—this service is a scheduler, responsible for running tasks (processes, 
scripts) based on a preestablished schedule. Anacron will run tasks that were sched-
uled at times that the system was not available. Anacron runs such tasks at the first 
opportunity after the system has been restarted/resumed. The configuration file for 
anacron is /etc/anacrontab. Of the scheduled activities that might be preset for ana-
crontab are the entries in the directories /etc/cron.daily, /etc/cron.weekly, and /etc/
cron.monthly based on those intervals (daily, weekly, monthly). See crontab below 
for more detail.
• atd—the at daemon is a one-time scheduler. It runs processes that were scheduled 
through either the 
at
or 
batch
commands. In at, the task is scheduled for a specific 
time and date. These can be absolute values such as today 13:50 (1:50 pm), tomorrow 
9:00 am, or 12/31/15 12:00 pm, or a time relative to now such as now 
+
5 minutes, 
now 
+
2 hours, now 
+
1 day. You can also use terms such as noon, midnight, and 
teatime. The batch program executes scheduled processes when the CPU’s load drops 
below 80%. The at daemon also permits a user to inspect and remove waiting at and 
batch jobs using the commands atq and atrm, respectively. We examine at and batch 
in Chapter 14.
• auditd—this is the Linux Auditing System daemon, responsible for creating log 
entries of specified activities no matter who performs those actions. There are two 
programs and three files related to auditd. First is the 
auditd
program itself. Second 
is 
auditctl
, which the system administrator will use to start and stop the audit 
daemon. It is auditctl, which, when started, will read in the configuration rules.
This leads us to the three files. The first is the 
auditd.conf
file, which is a stan-
dard configuration file. The configuration file specifies how auditd will operate such 
as the location of the log file, the action of whether log files will be rotated, and the 
number of log files to rotate between, but it does not specify the logging activities. 
Instead, logging activities are stored as rules in a second data file, 
audit.rules
. 
Rules vary from generic to specific.
In Table 11.4, we see some of the types of rules that you can specify. One such rule 
could be used to log attempts to write to or alter the attributes of the file /etc/foobar.
txt using
-w /etc/foobar.txt –p wa

---

System Initialization and Services
◾
461
and another rule could be used to log all normal users (UID 
>
199) who issue rmdir 
or mkdir operations:
-a entry,always –S mkdir –S rmdir –F UID 
>
199
The third file is another configuration file, stored under /
etc/sysconfig/
auditd
. This file contains options for auditd rather than configuration rules. We 
will briefly examine the two .conf files in Section 11.7 of this chapter.
• crond—this is the daemon for handling cron jobs, which, unlike at and batch jobs, 
are scheduled to recur based on some pattern such as hourly or weekly. To run a 
cron job, you use the program crontab. The crontab program is somewhat more 
complicated to use than the at program. For crontab, you specify a file that contains 
the recurrence information and the process(es) to be executed. You specify each 
process and recurrence in one line of the file. The file can contain any number of 
process/recurrence entries. Since the entry must fit on one line, lengthy entries of 
processes can be placed into a script so that the process listed is merely the script 
to execute. The cron daemon, crond, examines all scheduled cron jobs against the 
current time to see if any should be executed. This can happen as frequently as 
every minute.
Each user is able to submit a single crontab job. Thus, a user who wishes to add 
other recurring events will have to modify the current crontab job (if one has been 
submitted). The crontab instruction permits options of -l to inspect the current 
crontab jobs, -r to remove the current crontab jobs (as they are all bundled in one file, 
this removes the entire file) and -e to edit the current crontab jobs (if the user chooses 
to handle the scheduled jobs via an editor rather than through a file).
The recurrence information is broken into five parts: the minute, the hour (0–23), 
the day of the month (1–31), the month (1–12, or jan, feb, mar), and the day of the 
week (0–6, where 0 is Sunday and 6 is Saturday). Only relevant portions are specified; 
otherwise, * is used to indicate a wildcard. You can also specify multiple recurrences 
TABLE 11.4 
audit.rules Rule Examples