Joe Wulf
Tue, 27 Dec 2011 08:31:27 -0800
Prelink tends to run in the early hours, by default. I'd think that your tripwire scans get initiated sometime after a system has been built/kickstarted/PXE-booted and that 4am prelink has already ran its course.
>________________________________ > From: Tim Evans <tkev...@tkevans.com> >To: Red Hat Enterprise Linux 5 (Tikanga) discussion mailing-list ><rhelv5-list@redhat.com>; Clint Hughes <chug...@jjsheeran.com> >Sent: Tuesday, December 27, 2011 10:55 AM >Subject: [rhelv5-list] TripWire and Prelink Questions > >We've been running TripWire on one of our systems for several years, and have >never had issues with it except those that would be expected when yum-ming the >system with updates. > >Suddenly, yesterday morning, we have massive checksum differences reported. I >seem to remember a discussion on this list in the last few months about >prelink, so I checked its config on the system. It is turned on, and >/etc/prelink.cache is dated at 04:02 yesterday. Since the daily tripwire scan >is run out of /etc/cron.daily, it would've run at shortly after 04:00 as well, >so I'm WAG-ing there's a connection here. > >Question is: why have we never seen this before in all the years since we >upgraded the system to RHEL 5.x? > >Thanks. >-- Tim Evans, TKEvans.com, Inc. | 5 Chestnut Court >UNIX System Admin Consulting | Owings Mills, MD 21117 >http://www.tkevans.com/ | 443-394-3864 >http://www.come-here.com/News/ | tkev...@tkevans.com > >_______________________________________________ >rhelv5-list mailing list >rhelv5-list@redhat.com >https://www.redhat.com/mailman/listinfo/rhelv5-list > > >
_______________________________________________ rhelv5-list mailing list rhelv5-list@redhat.com https://www.redhat.com/mailman/listinfo/rhelv5-list