From: Richard Hirst (richard.hirst@pipex.net)
Date: Mon Oct 15 2007 - 06:22:28 EDT
Hello Managers,
We are running Solaris 9 on a number of servers. We run tripwire to monitor
changes and check the integrity of the systems. On some of the servers, at a
fairly regular interval, the inode modification time of (almost?) all files
is updated, making the output from tripwire pretty useless. An example of
the output is below:
/usr/sbin/psrset
st_ctime: Sun Oct 14 07:48:55 2007 Thu Sep 27 08:04:19 2007
---> File: '/usr/sbin/psrset'
---> Update entry? [YN(y)nh?]
bash-2.05# ls -lc /usr/sbin/psrset
-r-xr-xr-x 1 root sys 12576 Oct 14 07:48 /usr/sbin/psrset
I've checked the md5 of some of these files against the Sun fingerprint
database, and they check out.
There was nobody logged in at the time of the changes, and nothing running
in cron (other than sar).
Any suggestions as to why this is happening would be much appreciated!
Richard Hirst
Pipex
_______________________________________________
sunmanagers mailing list
sunmanagers@sunmanagers.org
http://www.sunmanagers.org/mailman/listinfo/sunmanagers
This archive was generated by hypermail 2.1.7 : Wed Apr 09 2008 - 23:42:25 EDT