[Aide] hash cannot be calculated for it - Attribute ctime has been changed

Erik Damsgaard edamsgaa at csc.com
Mon Sep 20 12:49:25 EEST 2010


I noticed this error recently. It only lasted for 1 check then disappeared 
again. I run checks every 5 minutes for test purposes at the moment.

File /opt/oracle/infra/portal/oip/objects/addpage.gif was changed so that 
hash cannot be calculated for it
Attribute ctime has been changed
Entry /opt/oracle/infra/portal/oip/objects/addpage.gif in databases has 
different attributes: 3b3d b3d
File /opt/oracle/infra/sysman/j2ee/tldcache/standard_jar/permittedTaglibs 
was changed so that hash cannot be calculated for it
Attribute ctime has been changed
Entry /opt/oracle/infra/sysman/j2ee/tldcache/standard_jar/permittedTaglibs 
in databases has different attributes: 3b3d b3d

Any ideas ?


I am running Redhat 
Aide was compiled on 
 2.6.9-78.0.13.EL #1 Wed Jan 7 17:31:05 EST 2009 i686 athlon i386 
GNU/Linux

Aide --version

Aide 0.15.1

Compiled with the following options:

WITH_MMAP
WITH_LSTAT64
WITH_READDIR64
WITH_ZLIB
WITH_MHASH
CONFIG_FILE = "/usr/local/etc/aide.conf"

Aide check is conducted on 
Linux xxxxxxxxxx 2.6.9-34.0.1.ELsmp #1 SMP Wed May 17 17:05:24 EDT 2006 
i686 athlon i386 GNU/Linux

The configuration on /opt is
Normc=p+i+n+u+g+s+m+md5+sha1


Regards
---------------------------
ERIK DAMSGAARD
Security Analyst
CSC
GSS Nordic | Tell (+45 36146217) | Cell (+45 29236217) | edamsgaa at csc.com 
| www.csc.com/dk


CSC • This is a PRIVATE message. If you are not the intended recipient, 
please delete without copying and kindly advise us by e-mail of the 
mistake in delivery.  NOTE: Regardless of content, this e-mail shall not 
operate to bind CSC to any order or other contract unless pursuant to 
explicit written agreement or government initiative expressly permitting 
the use of e-mail for such purpose
 • 
CSC Danmark A/S • Registered Office: Retortvej 8, DK - 2500 Valby, Denmark 
• Registered in Denmark No: 15231599
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://mailman.cs.tut.fi/pipermail/aide/attachments/20100920/9128c2c1/attachment.html 


More information about the Aide mailing list