On 2011-06-28 1:27 PM, John Horne wrote: > When you run 'rkhunter --propupd' it creates a local database of the > files to be monitored and records the modification date/time of each > file. That date/time can be anything (7 May in your example), and comes > from the file itself. The date/time is when the file was last modified > by the operating system. Rkhunter does not modify the file date/time in > any way. So, the modification time of a file comes from the file itself, > and is not when 'rkhunter --propupd' was run.
Right - so, even if a files properties had changed, running --propupd reset rkhunters database so it should no longer think it is changed, correct? >> Also - any idea why I'm getting duplicates of every list message? > Nope, no idea. I'm not receiving duplicates, so it can't be the > sourceforge mail servers unless you have something like 2 email > addresses registered on the rkhunter mailing list Yeah, I forgot I had registered a while back with a plussed address... I unsubbed that one... thx for the memory jog... ------------------------------------------------------------------------------ All of the data generated in your IT infrastructure is seriously valuable. Why? It contains a definitive record of application performance, security threats, fraudulent activity, and more. Splunk takes this data and makes sense of it. IT sense. And common sense. http://p.sf.net/sfu/splunk-d2d-c2 _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users
