[Aide] Problems with S (check for growing size)

[Montserrat Calero Marchante]

Hello

I've installed AIDE  (aide-0.10-sol9-sparc-local.gz) on a Solaris SPARC
version 9 platform.

I've some problems with the following default group: S (check for
growing size). i've been making tests to know the behaviour of this
pamaremter over the /var/adm/sulog file. The problem is that
#aide --check don't detect any change on this file, even if it's
increassing or decreassing.

Bellow the aide.conf file I've used:


@@define BINDIR /usr/local/bin
@@define CONFDIR /usr/local/etc
@@define DBDIR /usr/local/etc
@@define LOGDIR /var/adm

# the database
database=file:@@{DBDIR}/aide.db
database_out=file:@@{DBDIR}/aide.db.new
# reporting options
#report_url=file:@@{LOGDIR}/aide.log
report_url=file:/var/log/aide.log
verbose=20
#warn_dead_symlinks=yes


# main configuration
/var/adm/sulog$         S

There, the aide.db contents:

@@begin_db
# This file was generated by Aide, version 0.10
# Time of generation was 2005-04-04 09:56:06
@@db_spec name lname attr size
/var/adm/sulog 0 4194305 70
@@end_db

TEST1: Increase size /var/adm/sulog
RESULT1:  /usr/local/bin/aide --check

AIDE, version 0.10

### All files match AIDE database.  Looks okay!

TEST2: Decrease size /var/adm/sulog
RESULT2:  /usr/local/bin/aide --check

AIDE, version 0.10

### All files match AIDE database.  Looks okay!

Any idea or suggestion about AIDE don't say anything about de sulog
growing or decreasse size?

Thanks in advance

Montse



-- 
_________________________________________________________________
Montse Calero Marchante
Project Engineer / Client Solutions

Sun Microsystems Iberica
Centro Empresarial Parque Norte
C/ Serrano Galvache, 56  -  28033 Madrid - SPAIN
Oficina: +34 91 767 6587
Movil: 696927125
_________________________________________________________________