Hi John, Thank you for suggesting that prelinking may have changed my files' inodes a few weeks ago.
I checked into it, and indeed the hosting company said it runs prelink at the hypervisor (Virtuozzo) level, and all the files with changed inodes are in a directory (/sbin) that's shared between the hypervisor, and several virtual private servers like mine. The up-shot is that I'm not 100% certain that prelinking is to blame, but I wanted to let you know that I definitely found evidence that you were right. Thank you for suggesting it, ~K ------------------------------------------------------------------------------ All the data continuously generated in your IT infrastructure contains a definitive record of customers, application performance, security threats, fraudulent activity and more. Splunk takes this data and makes sense of it. Business sense. IT sense. Common sense. http://p.sf.net/sfu/splunk-d2dcopy1 _______________________________________________ Rkhunter-users mailing list Rkhunter-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/rkhunter-users