On Tue, May 04, 2021 at 09:32:49PM -0500, David Wright wrote: > It looks reasonable for determining whether your system files are > being interfered with. But you just showed one example from the > log, which was for the /etc/.pwd.lock lockfile. I assume you don't > have 2757 of these but, rather, the names of an assortment of files.
That's an interesting interpretation. If that's actually *true*, I wish the OP had made that more clear. I interpreted it as literally being thousands of instances of the *same* file, the one shown in the Subject: header and in the original message body. (In which case, removing iwatch will certainly stop the logging, but it won't stop whoever is locking and unlocking your passwd/shadow files thousands of times, which is something I might care enough to investigate -- and is a great reason for installing iwatch, to look for such a thing.) (Also I'd never heard of "monkeysphere" before and didn't even know that openssh-client suggested it. So it's been an educational thread.)