Hello, I am running AIDE an some servers and one of them is causing trouble. I get warnings about once a day, that a file (usually a lib in /usr/lib) has changed. Two hours later I get a message that the file had changed again but then the checksums are the same like in the very beginning.
An example: --- AIDE found differences between database and filesystem!! Start timestamp: 2001-05-31 15:00:00 Summary: Total number of files=4773,added files=0,removed files=0,changed files=1 Changed files: changed:/usr/lib/libc.a Detailed information about changes: File: /usr/lib/libc.a MD5: old = AZtOCmBe+Cr+LTCbBsi2SQ== , new = XMpiH0UCDsxTvLTRrkuuiQ== SHA1: old = +xTqrFAde4iSTtVex3yvTYrSGDg= , new = d55H3iP/iNwu5MSADqcT3Sy11Qc= RMD160: old = 79R7lFnQLeAu/tLwe+2vlS0ZaIk= , new = 6b9nHQV6DJx1M+ryv1JWbjj4W+I= TIGER: old = Hquu3dSi7enJvjsRSy2T7Iu0iGtf9sbw , new = KTZVvc7cBcSGvpEE4DgaNrfWj31tYtF4 --- Next warning: --- AIDE found differences between database and filesystem!! Start timestamp: 2001-05-31 17:00:01 Summary: Total number of files=4773,added files=0,removed files=0,changed files=1 Changed files: changed:/usr/lib/libc.a Detailed information about changes: File: /usr/lib/libc.a MD5: old = XMpiH0UCDsxTvLTRrkuuiQ== , new = AZtOCmBe+Cr+LTCbBsi2SQ== SHA1: old = d55H3iP/iNwu5MSADqcT3Sy11Qc= , new = +xTqrFAde4iSTtVex3yvTYrSGDg= RMD160: old = 6b9nHQV6DJx1M+ryv1JWbjj4W+I= , new = 79R7lFnQLeAu/tLwe+2vlS0ZaIk= TIGER: old = KTZVvc7cBcSGvpEE4DgaNrfWj31tYtF4 , new = Hquu3dSi7enJvjsRSy2T7Iu0iGtf9sbw --- I was thinking of bad memory that might cause this behaviour. Is it possible? And why does it happen to libs all the time and not with some file in /sbin? Or could there be something wrong with the filesystem? We are running the exact same version of AIDE (0.7) on six servers and just this server does this. Thanks for any help, Phil
