ps outpus a header, which give us one more line.

My suggestion would be:

# ls -d /proc/[0-9]* | wc -l; ps -A h | wc -l

My results:
108
108

ls –color=none -d /proc/* | grep “[0-9]” | wc-l; ps aux |wc -l

This should fix the difference between the two commands.

Don’t be afraid Just try to find out what’s the culprit. Check my previous answers above and try to get more into details as to why your system is giving you these outputs.

And, as said numerous times before (you guys should read a “maybe” as a “maybe”, not as a “surely it’s like I wrote, no doubt about that”), it could be that it was just a false positive.

There’s no way for me to know what sort of things you guys are running on your systems (operating systems, kernels, softwares, versions, patches, etc) so, I for one would assume that I’m the only who knows more about my specific system/setup than a random Don Joe at the IntarWebs out there

Regards,

Well, the command line, exactly as I published it, worked fine on a lot of my personal systems, all of them based on Debian unstable (Linux kernel 2.6.26).

I don’t know if you’re using Debian or even Linux, but as virtually 100% of my readers are aware that I’m a Debian user myself, they should be advised that the command line runs fine on such a system.

BTW, the proposed command line you gave in your comment doesn’t work on any of my Debian unstable systems at all.

First, you have a “wc-l” when it should be “wc -l”. You are lacking a space after the “c” and before the minus signal.

But even fixing this, I still get the following :

andrelop@foolish:~$ ls -d1 /proc/* | grep “[0-9]” | wc -l; ps aux |wc -l
0
125
andrelop@foolish:~$

So, I think my original command line, when executed on a standard Debian unstable system as pointed previsouly, works fine.

Regards,

As I said previously, this “may” mean your “ps” is compromised. It’s not a clear and indisputable sign that it is really compromised.

I’m not going to tell anyone that one should trust only this small trick to slap a “compromised” stick in one’s system.

You should try to find out which differences you have in these two outputs checking more closely at your /proc and comparing it to your “ps” output to try and find suspicious signs.

Also, checking your “ps” binary mdsum/sha1sum against a know good binary is surely a good thing to do.

ls -d1 /proc/* | grep “[0-9]” | wc-l; ps aux |wc -l

This should be correct, ‘grep’ has to have quotes and ‘ls’ default is to show more than one command per line.

Should I be worried? What do I do to fix that?