We are running tripwire on several of our systems. This morning we received a
report indicating that st_ctime had changed on a file. This equates to the
ctime reported by "find" (change in inode number) and when I checked, I found
that the file was flagged when I ran "find . -ctime -1" on the directory. The
file passed all of the other checksum tests. In looking further, other files
and directories which should have been stable also are flagged with find -ctime
-1. Is there a logical explanation for this?
--SHeila
--
Sheila Hollenbaugh Sr. Computer Systems Engineer (O-)
Wright State University College of Engineering & Computer Science
Dayton, OH 45435 http://www.cs.wright.edu/people/staff/shollen/
shollen_at_cs.wright.edu Voice: (937) 775-5077 FAX: (937) 775-5009
Received on Fri Apr 25 1997 - 14:41:26 NZST