RE: Re: Why do all of the files in /etc get changedevery oncein a while?

I would use the stat command on a file in /etc/ and another in somewhere
like bin and see if the timestamps match ie

stat <filename> 

That way you can see if the backup is effecting all files and tripwire
is only taking notice of some , I think some software uses the change
timestamp to amrk when the last full backup was done.

-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of Aaron Bliss
Sent: 10 March 2009 01:05
To: 'Discussions about Red Hat Network (rhn.redhat.com)'
Subject: RE: [rhn-users] Re: Why do all of the files in /etc get
changedevery oncein a while?

Definitely sounds odd...we use Netbackup for backups and ossec for,
among other things, to ensure file system integrity and have not
observed what you are seeing...

Aaron

-----Original Message-----
From: [email protected] [mailto:[email protected]]
On Behalf Of Cameron Simpson
Sent: Monday, March 09, 2009 7:41 PM
To: Discussions about Red Hat Network (rhn.redhat.com)
Subject: [rhn-users] Re: Why do all of the files in /etc get changed
every oncein a while?

On 09Mar2009 16:27, Christopher L. Barnard <[email protected]> wrote:
| No system updates have been done, but full backups correspond to the 
| tripwire reports.  But why would full backups change the timestamp of 
| all of the files in /etc but not alter any others?

Is it modification time (mtime) or the access time (atime) or the
change-to-inode time (ctime)? If it is the mtime, something is odd. The
others might easily be changed by backup or integrity software (eg
tripwire itself). Do your backups only back up specific parts of the
filesystem? Likewise tripwire?
--
Cameron Simpson <[email protected]> DoD#743
http://www.cskk.ezoshosting.com/cs/

It is not true that life is one damn thing after another -- it's one
damn
thing over and over.    - Edna St. Vincent Millay

_______________________________________________
rhn-users mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/rhn-users

_______________________________________________
rhn-users mailing list
[email protected]
https://www.redhat.com/mailman/listinfo/rhn-users

-- 
Disclaimer: This e-mail and any attachments are confidential and intended solely for the use of the recipient(s) to whom they are addressed. If you have received it in error, please destroy all copies and inform the sender. This email and any attachments are believed to be free from viruses but BBSRC accepts no liability in connection therewith.