Re: Does the on-disk image of an executable ever change?

2009-11-05 Thread Michael ODonnell
Have you done straight (non-hashed) content-comparison of any of these files? Are they actually gratuitously different in content, or are they just truncated on one system? MD5sums are effectively dependant on file-size The files were the same size but differed in various locations

Does the on-disk image of an executable ever change?

2009-11-04 Thread Michael ODonnell
I'm looking at some supposedly identical CentOS5.3 systems that are behaving strangely and while grasping at straws I generated lists of the MD5 sums of all the files on the root partitions and I'm seeing differences in the on-disk images of things like /sbin/mount and /lib64/libblkid.so.1.0 that

Re: Does the on-disk image of an executable ever change?

2009-11-04 Thread Ben Scott
On Wed, Nov 4, 2009 at 3:50 PM, Michael ODonnell michael.odonn...@comcast.net wrote: I'm seeing differences in the on-disk images of things like /sbin/mount and /lib64/libblkid.so.1.0 that AFAIK are supposed to be entirely static. Use rpm -qif /lib64/libblkid.so.1.0 to identify the exact

Re: Does the on-disk image of an executable ever change?

2009-11-04 Thread Kevin D. Clark
Michael ODonnell writes: I'm looking at some supposedly identical CentOS5.3 systems that are behaving strangely and while grasping at straws I generated lists of the MD5 sums of all the files on the root partitions and I'm seeing differences in the on-disk images of things like /sbin/mount

Re: Does the on-disk image of an executable ever change?

2009-11-04 Thread Michael ODonnell
I'm running an rpm --verify --all pass on those machines right now and it's showing quite a few indications of unexpected differences based on the info recorded in the RPM database. Ben is right; that's a very nice feature of RPM. When I captured the output in a file and then said things like

Re: Does the on-disk image of an executable ever change?

2009-11-04 Thread Alan Johnson
On Wed, Nov 4, 2009 at 4:56 PM, Michael ODonnell michael.odonn...@comcast.net wrote: ...so that system seems to have suffered disk corruption or compromise; I'm assuming the former given the large number of affected files but I guess I can't rule out the latter. Of course, if it is the

Re: Does the on-disk image of an executable ever change?

2009-11-04 Thread Ben Scott
On Wed, Nov 4, 2009 at 4:56 PM, Michael ODonnell michael.odonn...@comcast.net wrote: ...so that system seems to have suffered disk corruption or compromise ... Certainly some kind of corruption or compromise. There are other kinds of corruption beyond a bad disk, though. Logical corruption

Re: Does the on-disk image of an executable ever change?

2009-11-04 Thread Joshua Judson Rosen
Michael ODonnell michael.odonn...@comcast.net writes: I'm running an rpm --verify --all pass on those machines right now and it's showing quite a few indications of unexpected differences based on the info recorded in the RPM database. Ben is right; that's a very nice feature of RPM. When I