rkhunter found this...

[Dave Ihnat]

On Thu, Mar 26, 2009 at 08:13:41PM -0400, Tom Horsley wrote:
> On Thu, 26 Mar 2009 14:40:06 -0700
> Daniel B. Thurman wrote:
> 
> > Looking @ /dev/nul:
> > =====================
> > # more /dev/nul
> > nsdc: no patch necessary.
> > =====================
> > 
> > What does this mean?
> 
> It means some script somewhere did an rm -f on /dev/null
> then later some other script redirected output to /dev/null
> thus creating it as a regular file.

If it's really "/dev/nul" instead of "/dev/null", there IS a problem
somewhere, and yes, probably a script...
--
	Dave Ihnat
	dihnat at dminet.com