Re: [Aide] different attributes (here3)

[Peter Jordan]

Richard van den Berg, Sat Apr 04 2009 17:26:14 GMT+0200 (CEST):
> On 4/4/09 4:25 PM, Peter Jordan wrote:
>> no the configuration has not changed (i would see that in
>> /etc/aide/aide.conf.d/) and yes i moved /var/lib/aide.db.new to
>> /var/lib/aide.db
>>   
> 
> There is something very strange going on because aide seems to think
> that all these files have the same inode as /var/log/aide of the
> previous aide.db:
> 
>> File "/var/log/wpa_action.wlan0.log.4.gz" "/var/log/aide" in databases
>> has different attributes (here3), 81d,40807fc3d
>> File "/var/log/wpa_supplicant.wlan0.log.3.gz" "/var/log/aide" in
>> databases has different attributes (here3), 81d,40807fc3d
>> File "/var/log/wpa_supplicant.wlan0.log.1.gz" "/var/log/aide" in
>> databases has different attributes (here3), 81d,41807fc3d
>> File "/var/log/wpa_action.wlan0.log.2.gz" "/var/log/aide" in databases
>> has different attributes (here3), 81d,40807fc3d
>> File "/var/log/dmesg.3.gz" "/var/log/aide" in databases has different
>> attributes (here3), 81d,40807fc3d
>> File "/var/log/wpa_supplicant.wlan0.log.4.gz" "/var/log/aide" in
>> databases has different attributes (here3), 81d,40807fc3d
>> File "/var/log/wpa_supplicant.wlan0.log.2.gz" "/var/log/aide" in
>> databases has different attributes (here3), 81d,40807fc3d
>> File "/var/log/wpa_supplicant.wlan0.log.5.gz" "/var/log/aide" in
>> databases has different attributes (here3), 81d,42807fc3d
>>   
> 
> Then the next lines suggest /var/log/xdm.log in the aide.db.new has the
> same inode as all these files in the old aide.db:
>> File "/var/log/xdm.log" "/var/log/dmesg.1.gz" in databases has different
>> attributes (here3), 41807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/daemon.log.3.gz" in databases has
>> different attributes (here3), 40807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/syslog.3.gz" in databases has
>> different attributes (here3), 40807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/wpa_action.wlan0.log.1.gz" in
>> databases has different attributes (here3), 41807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/dmesg.2.gz" in databases has different
>> attributes (here3), 40807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/daemon.log.4.gz" in databases has
>> different attributes (here3), 42807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/debug.3.gz" in databases has different
>> attributes (here3), 40807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/auth.log.3.gz" in databases has
>> different attributes (here3), 40807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/auth.log.4.gz" in databases has
>> different attributes (here3), 42807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/wpa_action.wlan0.log.3.gz" in
>> databases has different attributes (here3), 40807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/kern.log.3.gz" in databases has
>> different attributes (here3), 40807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/dmesg.4.gz" in databases has different
>> attributes (here3), 42807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/wpa_action.wlan0.log.5.gz" in
>> databases has different attributes (here3), 42807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/syslog.2.gz" in databases has
>> different attributes (here3), 41807fc3d,40007fc3d
>> File "/var/log/xdm.log" "/var/log/syslog.6.gz" in databases has
>> different attributes (here3), 40807fc3d,40007fc3d
> 
> Can you upload the aide.db and aide.db.new that produced this output to
> ftp.vdberg.org ? (Also upload a new set of error messages if you do not
> have the original aide.db files.)
> 
> Regards,
> 
> Richard

yes I can rerun aide, but I'm not allowed to upload the whole databases,
can i grep the corresponding lines?

PJ

_______________________________________________
Aide mailing list
Aide@cs.tut.fi
https://mailman.cs.tut.fi/mailman/listinfo/aide