On Wed, Oct 17, 2012 at 7:39 PM, maxjar10 <[email protected]> wrote: > I have just installed ossec yesterday and today I was notified that there > was a change in /usr/bin/inotifywatch. I know that I had seen someone post a > configuration that ignored this file but I'm wondering if this is a safe > thing to do. I can't figure out why this binary should change. > > Thanks!
Figure out why it changed first, then decide. Was it prelinking?
