AIDE and strange differences
Hello,
I am running AIDE an some servers and one of them is causing trouble.
I get warnings about once a day, that a file (usually a lib in
/usr/lib) has changed. Two hours later I get a message that the file
had changed again but then the checksums are the same like in the very
beginning.
An example:
---
AIDE found differences between database and filesystem!!
Start timestamp: 2001-05-31 15:00:00
Summary:
Total number of files=4773,added files=0,removed files=0,changed files=1
Changed files:
changed:/usr/lib/libc.a
Detailed information about changes:
File: /usr/lib/libc.a
MD5: old = AZtOCmBe+Cr+LTCbBsi2SQ== , new = XMpiH0UCDsxTvLTRrkuuiQ==
SHA1: old = +xTqrFAde4iSTtVex3yvTYrSGDg= , new = d55H3iP/iNwu5MSADqcT3Sy11Qc=
RMD160: old = 79R7lFnQLeAu/tLwe+2vlS0ZaIk= , new = 6b9nHQV6DJx1M+ryv1JWbjj4W+I=
TIGER: old = Hquu3dSi7enJvjsRSy2T7Iu0iGtf9sbw , new = KTZVvc7cBcSGvpEE4DgaNrfWj31tYtF4
---
Next warning:
---
AIDE found differences between database and filesystem!!
Start timestamp: 2001-05-31 17:00:01
Summary:
Total number of files=4773,added files=0,removed files=0,changed files=1
Changed files:
changed:/usr/lib/libc.a
Detailed information about changes:
File: /usr/lib/libc.a
MD5: old = XMpiH0UCDsxTvLTRrkuuiQ== , new = AZtOCmBe+Cr+LTCbBsi2SQ==
SHA1: old = d55H3iP/iNwu5MSADqcT3Sy11Qc= , new = +xTqrFAde4iSTtVex3yvTYrSGDg=
RMD160: old = 6b9nHQV6DJx1M+ryv1JWbjj4W+I= , new = 79R7lFnQLeAu/tLwe+2vlS0ZaIk=
TIGER: old = KTZVvc7cBcSGvpEE4DgaNrfWj31tYtF4 , new = Hquu3dSi7enJvjsRSy2T7Iu0iGtf9sbw
---
I was thinking of bad memory that might cause this behaviour. Is it
possible? And why does it happen to libs all the time and not with
some file in /sbin?
Or could there be something wrong with the filesystem?
We are running the exact same version of AIDE (0.7) on six servers and
just this server does this.
Thanks for any help,
Phil
Reply to: