[CLUE-Tech] stat(2) and ctime st_ctime changes?

[Jim Ockers]

Hi Dave,

> Dave Hagerty wrote:
> > Hi group,
> > 
> > I'd like to bounce this situation off you.  We have a server that
> > runs tripwire enterprise for IDS.  It recently generated several
> > thousand critical errors in a tripwire report, and I was assigned
> > to investigate.
> > 
> > 
> Jim,
> 
>    How about:
> 
> http://www.derkeiler.com/Newsgroups/comp.os.linux.security/2002-01/1309.html
> 
> (to wit, a backup)

Thanks, that's exactly what it was.  It took us only a little while
to determine that nothing was going on other than Veritas NetBackup
running its weekly full backup of the system.  I'm not sure why we
never noticed this before from TripWire.

-- 
Jim Ockers, P.Eng. (ockers at ockers.net)
Contact info: please see http://www.ockers.net/