RedHat / CentOS file inode, checksum, & ctime changing

Osiris is very good at finding these changes.

example:

[204][server][cmp][/usr/bin/nslookup][checksum][7f7087ace44e1d14e984cd367df3b794cc1859a3][655c9d0f1328aa07f45a061825989809ae5b9885]
[206][server][cmp][/usr/bin/nslookup][inode][25595][25317]
[213][server][cmp][/usr/bin/nslookup][ctime][Thu Jun 29 21:43:51 2006][Sat Aug 12 04:02:21 2006]
[204][server][cmp][/usr/bin/nsupdate][checksum][721695ed63aed8b55d6978b1384a0250d26d4d15][cac7585a8520d619d1a507b160e7a35651db3563]
[206][server][cmp][/usr/bin/nsupdate][inode][21341][25780]
[213][server][cmp][/usr/bin/nsupdate][ctime][Thu Jun 29 21:43:53 2006][Sat Aug 12 04:02:22 2006]

I found that this can happen from /etc/cron.daily/prelink
— it is a little scarry that prelink changes files and does not even log the changes.
[CentOS] Several files’s checksum change without reason

Leave a Reply