[Aide] Reporting log files

[Marc Haber]

On Thu, Mar 29, 2007 at 10:42:54AM +0300, Pablo Virolainen wrote:
> On Wed, 28 Mar 2007, Marc Haber wrote:
> > On Wed, Mar 28, 2007 at 10:15:03AM +0300, Pablo Virolainen wrote:
> > > On Sun, 18 Mar 2007, Marc Haber wrote:
> > > > > Would it not be possible for Aide, since it records the previous
> > > > > log file size, to verify checksums over the initial part of the
> > > > > file comprising of the old size?  So the options for a growing
> > > > > logfile could include S+md5+sha1 and the hashes would know, as a
> > > > > result of the S option, that the old size is to be used to record
> > > > > the previous bits.
> > > >
> > > > Nice idea. wishlist request 1683255 in the aide feature request
> > > > tracker. Again, if I omitted something, please add there.
> > >
> > > This is not so easy. Actually this can't be implemented without knowing
> > > the original size (read from the database). So running init and then
> > > compare would be different than running update.
> >
> > Please explain, I don't seem to understand what you mean here.
> 
> When running init, AIDE don't known about 'original' size of the files
> which can grow, so AIDE can't calculate the hash value of the files (with
> old file sizes).

It has to assume an empty file then. Init doesn't look at a present
database at all.

>  But when running in update mode, AIDE knowns the old size and can
>  calculate hash value with the old file size.

Right.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835