Mirco Bauer wrote: > On Mon, 2005-07-18 at 15:29 +0200, Albert Dorofeev wrote: > >>Does anyone have any idea why the ctime would change >>so often for a file that is essentially not changing >>in any way, especially not the attributes? > > it's changing, the computer passwords are updated by the windows boxes > regularly also applied when a user changes his password, so tell the IDS > to ignore the ctime flag for that file.
If the passwords change, the contents of the file smbpasswd changes. IIRC, that means the mtime changes. Now, even if that is not the case, I am perfectly sure the passwords were not changed by users. The ctime is related to the change of the attributes of the file. Why would attributes change and how can I find out what changes them? I understand that it is most likely smb daemon but this is a strange behaviour to say the least: ctime_new=<[2005-07-18T09:44:55]> ctime_new=<[2005-07-18T14:53:10]> ctime_new=<[2005-07-18T18:00:00]> ctime_new=<[2005-07-18T22:00:00]> ctime_new=<[2005-07-19T02:00:00]> ctime_new=<[2005-07-19T06:00:00]> It seems to have settled into a pattern of updating the attributes every 4 hours. What gives? Albert -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
