[Aide] Weird AIDE problem

[Virolainen Pablo]

On Wed, 23 Mar 2005, John Farmer wrote:

> I'm noticing some strange behavior on our server and I wondered if anyone
> had seen anything like this before.
> Here is how it started. On this day:
>
> Start timestamp: 2005-03-15 15:00:01
>
> File: /usr/local/ssl/bin/openssl
> MD5 : WJvJGt/2UCv5nHph2RqTpQ== , 0HH05buevntg0SmoSlavvA==
>
>
> So I updated the aide database and then the next day.
>
> Start timestamp: 2005-03-16 02:00:02
>
> File: /usr/local/ssl/bin/openssl
> MD5 : 0HH05buevntg0SmoSlavvA== , WPOUrghNI3gE9TDt4DNqXA==
>
> So again I updated the aide database:
> Start timestamp: 2005-03-17 02:00:03
>
> File: /usr/local/ssl/bin/openssl
> MD5 : WPOUrghNI3gE9TDt4DNqXA== , WJvJGt/2UCv5nHph2RqTpQ==
>
>
> So I reloaded it one more time.
> Start timestamp: 2005-03-17 19:00:01
> File: /usr/local/ssl/bin/openssl
>    MD5      : WJvJGt/2UCv5nHph2RqTpQ==          ,
> 0HH05buevntg0SmoSlavvA==
>
>
>
> Around 2am and 2pm is when this server is under very heaving IO from doing
> backups.  The partition with the "changing" files is an EXT3 partition.
> Anyone have any ideas on why this is happening?

If the file doesn't change in reality, there must be a bug somewhere.
Might want to try configure switch "--without-mmap".

Duke NEMO / C.O.M.A
alias pablo the pallo virolainen