We've been running TripWire on one of our systems for several years, and
have never had issues with it except those that would be expected when
yum-ming the system with updates.
Suddenly, yesterday morning, we have massive checksum differences
reported. I seem to remember a discussion on this list in the last few
months about prelink, so I checked its config on the system. It is
turned on, and /etc/prelink.cache is dated at 04:02 yesterday. Since
the daily tripwire scan is run out of /etc/cron.daily, it would've run
at shortly after 04:00 as well, so I'm WAG-ing there's a connection here.
Question is: why have we never seen this before in all the years since
we upgraded the system to RHEL 5.x?
Thanks.
--
Tim Evans, TKEvans.com, Inc. | 5 Chestnut Court
UNIX System Admin Consulting | Owings Mills, MD 21117
http://www.tkevans.com/ | 443-394-3864
http://www.come-here.com/News/ | tkev...@tkevans.com
_______________________________________________
rhelv5-list mailing list
rhelv5-list@redhat.com
https://www.redhat.com/mailman/listinfo/rhelv5-list
