Old ps output was a dead giveaway: two "decnet-capture" bash procs and a raw "inotifywait". Install script at /usr/libexec/udev/journal-relay and invoke inotifywait through a /usr/libexec/udev/kmsg-watch symlink so both now render as plausible udev/journal helpers under casual inspection.
3.9 KiB
3.9 KiB