Prelink tends to run in the early hours, by default. I'd think that your
tripwire scans get initiated sometime after a system has been
built/kickstarted/PXE-booted and that 4am prelink has already ran its course.
>________________________________
> From: Tim Evans <tkev...@tkevans.com>
>To: Red Hat Enterprise Linux 5 (Tikanga) discussion mailing-list
><rhelv5-list@redhat.com>; Clint Hughes <chug...@jjsheeran.com>
>Sent: Tuesday, December 27, 2011 10:55 AM
>Subject: [rhelv5-list] TripWire and Prelink Questions
>
>We've been running TripWire on one of our systems for several years, and have
>never had issues with it except those that would be expected when yum-ming the
>system with updates.
>
>Suddenly, yesterday morning, we have massive checksum differences reported. I
>seem to remember a discussion on this list in the last few months about
>prelink, so I checked its config on the system. It is turned on, and
>/etc/prelink.cache is dated at 04:02 yesterday. Since the daily tripwire scan
>is run out of /etc/cron.daily, it would've run at shortly after 04:00 as well,
>so I'm WAG-ing there's a connection here.
>
>Question is: why have we never seen this before in all the years since we
>upgraded the system to RHEL 5.x?
>
>Thanks.
>-- Tim Evans, TKEvans.com, Inc. | 5 Chestnut Court
>UNIX System Admin Consulting | Owings Mills, MD 21117
>http://www.tkevans.com/ | 443-394-3864
>http://www.come-here.com/News/ | tkev...@tkevans.com
>
>_______________________________________________
>rhelv5-list mailing list
>rhelv5-list@redhat.com
>https://www.redhat.com/mailman/listinfo/rhelv5-list
>
>
>
_______________________________________________
rhelv5-list mailing list
rhelv5-list@redhat.com
https://www.redhat.com/mailman/listinfo/rhelv5-list
