Thanks to Rainer and Simon for their replies. I believe that it is likely that
the backup facility that we use is probably at fault, but am still
investigating to be sure. Since the file in question was /usr/bin/rsh, we were
understandably concerned...
The original question:
> We are running tripwire on several of our systems. This morning we received
a
> report indicating that st_ctime had changed on a file. This equates to the
> ctime reported by "find" (change in inode number) and when I checked, I found
> that the file was flagged when I ran "find . -ctime -1" on the directory.
The
> file passed all of the other checksum tests. In looking further, other files
> and directories which should have been stable also are flagged with find
-ctime
> -1. Is there a logical explanation for this?
On Apr 25, 3:09pm, Rainer Landes wrote:
> Subject: Re: Why would ctime on a file change?
> this has been discussed just recently in the context of cron
> failing to delete the system log files because the ctimes had
> been modified every night.
> Cause was a backup process which will modify the ctime
> (modification of the inode) but not the modification times of the file
> (modification of the file itself).
>
> Has the file in question been backed up during the time in question?
>
> regards,
>
>-- End of excerpt from Rainer Landes
On Apr 25, 2:00pm, Simon Earthrowl wrote:
> Subject: Re: Why would ctime on a file change?
> This happens whenever a process opens the file (not directories) with the
write
> option. This has caused a big headache with an application that never
changes
> the files it opens; and then backup needs to back them all up again!
>
> ctime on directories changes whenever a change is made to the directory, eg:
> chmod, chown, chgrp, creat(2)....
>
> Most system type files and utilities are nice, and open file properly; ie
> with readonly, so I would guess that there may be some other command than
what
> you do not normally use on these files. BTW What files are they?
>
> Simon
>-- End of excerpt from Simon Earthrowl
--
Sheila Hollenbaugh Sr. Computer Systems Engineer (O-)
Wright State University College of Engineering & Computer Science
Dayton, OH 45435 http://www.cs.wright.edu/people/staff/shollen/
shollen_at_cs.wright.edu Voice: (937) 775-5077 FAX: (937) 775-5009
Received on Fri Apr 25 1997 - 16:00:06 NZST