[Aide] FreeBSD and AIDE question

[Bob Proulx]

Kelly Martin wrote:
> Does anyone know why FreeBSD 6.2 and 6.3 would frequently change the
> following files or directories? Here are some examples that often come up in
> my daily AIDE reports:

I don't know about FreeBSD in particular but on Debian and on HP-UX a
weekly cron script is installed that walks every directory in the
system manpath and updates the index database caches.  Those are used
by whatis, apropos, man -k, etc. to quickly search man pages.  A
temporary file is created in the directory and removed and therefore
the timestamp of the directory itself is updated.

> changed: /usr/local/lib/perl5/5.8.8/perl/man/whatis
> changed: /usr/local/lib/perl5/5.8.8/man
> changed: /usr/local/lib/perl5/5.8.8/man/whatis
> changed: /usr/share/openssl/man
> changed: /usr/share/openssl/man/whatis
> changed: /usr/share/man
> changed: /usr/share/man/whatis

Looks like it to me.

> I'm just a bit miffed why these files or directories would be changing on an
> almost daily basis... any thoughts?

Check the system crontabs for something running mkwhatis or mandb or
something similar.  If you are not updating anything in the man
directories then instead of running the update by cron it could run
only when something changes in those directories.

Bob