[Aide] AIDE changing directory mtimes
Richard Dupuy
Richard.Dupuy at LA.GOV
Thu Mar 22 22:29:49 EET 2012
I'm having an odd problem with AIDE where it seems that the AIDE scan itself is changing the mtime and ctime on an odd list of directories as it rolls through the filesystems. First, this is a CentOS 6.2 system and these are the directories involved:
/bin
/lib
/lib/dbus-1
/lib/security/pam_krb5
/lib/udev
/sbin
/usr/bin
/usr/lib
/usr/lib/anaconda-runtime
/usr/lib/anaconda-runtime/loader
/usr/lib/cups/driver
/usr/lib/cups/filter
/usr/lib/festival/etc
/usr/lib/firefox
/usr/lib/gettext
/usr/lib/gnome-session/helpers
/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/bin
/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib
/usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib/i386/jli
/usr/lib/libgphoto2
/usr/lib/libv4l
/usr/lib/nspluginwrapper
/usr/lib/nss/unsupported-tools
/usr/lib/perl5/CORE
/usr/lib/pm-utils/bin
/usr/lib/sa
/usr/lib/sse2
/usr/lib/udev
/usr/lib/vte
/usr/lib/xulrunner-2
/usr/libexec
/usr/libexec/awk
/usr/libexec/certmonger
/usr/libexec/getconf
/usr/libexec/gnome-applets
/usr/libexec/gnome-screensaver
/usr/libexec/gstreamer-0.10
/usr/libexec/mc
/usr/libexec/oddjob
/usr/libexec/openssh
/usr/libexec/polkit-1
/usr/libexec/pulse
/usr/libexec/sssd
/usr/libexec/systemtap
/usr/libexec/utempter
/usr/sbin
The filesystem layout looks like this:
--[root at linux ~]# mount
/dev/mapper/vg_linux-lv_root on / type ext4 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw,gid=5,mode=620)
tmpfs on /dev/shm type tmpfs (rw)
/dev/mapper/vg_linux-lv_roots on /root type ext4 (rw)
/dev/sda1 on /boot type ext4 (rw)
/dev/mapper/vg_linux-lv_home on /home type ext4 (rw)
/dev/mapper/vg_linux-lv_opt on /opt type ext4 (rw)
/dev/mapper/vg_linux-lv_tmp on /tmp type ext4 (rw)
/dev/mapper/vg_linux-lv_usr on /usr type ext4 (rw)
/dev/mapper/vg_linux-lv_var on /var type ext4 (rw)
none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw)
sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
--[root at linux ~]# df -h
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_linux-lv_root
1.3G 214M 983M 18% /
tmpfs 504M 88K 504M 1% /dev/shm
/dev/mapper/vg_linux-lv_roots
504M 17M 462M 4% /root
/dev/sda1 504M 37M 442M 8% /boot
/dev/mapper/vg_linux-lv_home
1008M 34M 924M 4% /home
/dev/mapper/vg_linux-lv_opt
1008M 90M 868M 10% /opt
/dev/mapper/vg_linux-lv_tmp
1008M 34M 924M 4% /tmp
/dev/mapper/vg_linux-lv_usr
4.0G 2.1G 1.7G 56% /usr
/dev/mapper/vg_linux-lv_var
1008M 158M 799M 17% /var
--[root at linux ~]# aide -v
Aide 0.14
Compiled with the following options:
WITH_MMAP
WITH_POSIX_ACL
WITH_SELINUX
WITH_PRELINK
WITH_XATTR
WITH_LSTAT64
WITH_READDIR64
WITH_ZLIB
WITH_GCRYPT
WITH_AUDIT
CONFIG_FILE = "/etc/aide.conf"
--[root at linux ~]#
And finally, my /etc/aide.conf file is as follows:
# Current DOA/OCS/Unix maintained AIDE configuration file
# See the aide.conf man page or http://aide.sf.net/ for more information
@@define DBDIR /var/lib/aide
@@define LOGDIR /var/log/aide
# The location of the database to be read.
database=file:@@{DBDIR}/aide.db.gz
# The location of the database to be written.
database_out=file:@@{DBDIR}/aide.db.new.gz
# Whether to gzip the output to database
gzip_dbout=yes
# Default.
verbose=7
report_url=file:@@{LOGDIR}/aide.log
report_url=stdout
# custom scanning parameters
REASONABLE = p+l+n+u+g+s+b+m+c+acl+md5+rmd160+sha256
OWNERPERMS = p+l+n+u+g+acl
DIRECTORYPERM = p+l+u+g+acl
DEVICES = p+l+u+g+ANF+ARF+acl
### Scanning rules ###
# Keep track of the kernel
/boot REASONABLE
# Track base executables and libraries
/bin REASONABLE
/lib REASONABLE
/lib64 REASONABLE
/libexec REASONABLE
/sbin REASONABLE
# Track configuration files, with exceptions
/etc REASONABLE
/etc/shadow OWNERPERMS
# Track the contents of /usr, with some exceptions
/usr REASONABLE
!/usr/tmp
# Track the contents of /opt, with some exceptions
/opt REASONABLE
!/opt/local/.*/data
!/opt/local/.*/log
!/opt/local/.*/logs
# Track the root user's home directory
/root REASONABLE
/root/\..* OWNERPERMS
# Make sure a few key directories don't get compromised
/var$ DIRECTORYPERM
/tmp$ DIRECTORYPERM
/dev DEVICES
/$ DIRECTORYPERM
### ###
I suspect the distribution of filesystems has something to do with causing AIDE scans to affect the ctime and mtime of directories, but I'm not sure what would trigger that. Possibly something to do with cross-filesystem symlinks? I really have no idea, but the only work around I've found so far is to remove mtime and ctime monitoring from my config file (which I'd rather not do, but isn't so risky).
Otherwise, is there a way to write a selection line for recursively scanning a directory that will check the mtime and ctime for every file type except the directories?
(Oh, and I'm also having the problem where the / directory doesn't actually get scanned even though I have an explicit selection line requesting that, but it sounds as though that problem has been corrected upstream and will be fixed in a forthcoming release.)
And finally here's what happens when I run AIDE checks. Keep in mind that I've waited up to a couple of days between AIDE checks, verified that the ctime and mtime was unchanged before beginning an AIDE check, ran the check on a very still sandbox system, and then was notified that the mtime and ctime had changed on the same directories every time after the AIDE check was kicked off:
--[root at linux ~]# aide --check
AIDE found differences between database and filesystem!!
Start timestamp: 2012-03-22 15:11:14
Summary:
Total number of files: 87385
Added files: 0
Removed files: 0
Changed files: 46
---------------------------------------------------
Changed files:
---------------------------------------------------
changed: /usr/lib
changed: /usr/lib/pm-utils/bin
changed: /usr/lib/sa
changed: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib
changed: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib/i386/jli
changed: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/bin
changed: /usr/lib/perl5/CORE
changed: /usr/lib/gettext
changed: /usr/lib/gnome-session/helpers
changed: /usr/lib/firefox
changed: /usr/lib/anaconda-runtime
changed: /usr/lib/anaconda-runtime/loader
changed: /usr/lib/vte
changed: /usr/lib/libgphoto2
changed: /usr/lib/sse2
changed: /usr/lib/cups/driver
changed: /usr/lib/cups/filter
changed: /usr/lib/festival/etc
changed: /usr/lib/xulrunner-2
changed: /usr/lib/nspluginwrapper
changed: /usr/lib/udev
changed: /usr/lib/libv4l
changed: /usr/lib/nss/unsupported-tools
changed: /usr/sbin
changed: /usr/libexec
changed: /usr/libexec/mc
changed: /usr/libexec/pulse
changed: /usr/libexec/certmonger
changed: /usr/libexec/openssh
changed: /usr/libexec/oddjob
changed: /usr/libexec/getconf
changed: /usr/libexec/gnome-screensaver
changed: /usr/libexec/awk
changed: /usr/libexec/gnome-applets
changed: /usr/libexec/systemtap
changed: /usr/libexec/sssd
changed: /usr/libexec/gstreamer-0.10
changed: /usr/libexec/utempter
changed: /usr/libexec/polkit-1
changed: /usr/bin
changed: /sbin
changed: /lib
changed: /lib/dbus-1
changed: /lib/udev
changed: /lib/security/pam_krb5
changed: /bin
--------------------------------------------------
Detailed information about changes:
---------------------------------------------------
Directory: /usr/lib
Mtime : 2012-03-22 14:44:18 , 2012-03-22 15:07:07
Ctime : 2012-03-22 14:44:18 , 2012-03-22 15:07:07
Directory: /usr/lib/pm-utils/bin
Mtime : 2012-03-22 14:44:18 , 2012-03-22 15:07:08
Ctime : 2012-03-22 14:44:18 , 2012-03-22 15:07:08
Directory: /usr/lib/sa
Mtime : 2012-03-22 14:44:18 , 2012-03-22 15:07:08
Ctime : 2012-03-22 14:44:18 , 2012-03-22 15:07:08
Directory: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib
Mtime : 2012-03-22 14:44:20 , 2012-03-22 15:07:10
Ctime : 2012-03-22 14:44:20 , 2012-03-22 15:07:10
Directory: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib/i386/jli
Mtime : 2012-03-22 14:44:23 , 2012-03-22 15:07:12
Ctime : 2012-03-22 14:44:23 , 2012-03-22 15:07:12
Directory: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/bin
Mtime : 2012-03-22 14:44:24 , 2012-03-22 15:07:14
Ctime : 2012-03-22 14:44:24 , 2012-03-22 15:07:14
Directory: /usr/lib/perl5/CORE
Mtime : 2012-03-22 14:44:27 , 2012-03-22 15:07:16
Ctime : 2012-03-22 14:44:27 , 2012-03-22 15:07:16
Directory: /usr/lib/gettext
Mtime : 2012-03-22 14:44:28 , 2012-03-22 15:07:17
Ctime : 2012-03-22 14:44:28 , 2012-03-22 15:07:17
Directory: /usr/lib/gnome-session/helpers
Mtime : 2012-03-22 14:44:28 , 2012-03-22 15:07:17
Ctime : 2012-03-22 14:44:28 , 2012-03-22 15:07:17
Directory: /usr/lib/firefox
Mtime : 2012-03-22 14:44:28 , 2012-03-22 15:07:17
Ctime : 2012-03-22 14:44:28 , 2012-03-22 15:07:17
Directory: /usr/lib/anaconda-runtime
Mtime : 2012-03-22 14:44:30 , 2012-03-22 15:07:19
Ctime : 2012-03-22 14:44:30 , 2012-03-22 15:07:19
Directory: /usr/lib/anaconda-runtime/loader
Mtime : 2012-03-22 14:44:30 , 2012-03-22 15:07:19
Ctime : 2012-03-22 14:44:30 , 2012-03-22 15:07:19
Directory: /usr/lib/vte
Mtime : 2012-03-22 14:44:47 , 2012-03-22 15:07:36
Ctime : 2012-03-22 14:44:47 , 2012-03-22 15:07:36
Directory: /usr/lib/libgphoto2
Mtime : 2012-03-22 14:44:47 , 2012-03-22 15:07:36
Ctime : 2012-03-22 14:44:47 , 2012-03-22 15:07:36
Directory: /usr/lib/sse2
Mtime : 2012-03-22 14:44:48 , 2012-03-22 15:07:37
Ctime : 2012-03-22 14:44:48 , 2012-03-22 15:07:37
Directory: /usr/lib/cups/driver
Mtime : 2012-03-22 14:44:48 , 2012-03-22 15:07:37
Ctime : 2012-03-22 14:44:48 , 2012-03-22 15:07:37
Directory: /usr/lib/cups/filter
Mtime : 2012-03-22 14:44:49 , 2012-03-22 15:07:38
Ctime : 2012-03-22 14:44:49 , 2012-03-22 15:07:38
Directory: /usr/lib/festival/etc
Mtime : 2012-03-22 14:44:49 , 2012-03-22 15:07:38
Ctime : 2012-03-22 14:44:49 , 2012-03-22 15:07:38
Directory: /usr/lib/xulrunner-2
Mtime : 2012-03-22 14:44:53 , 2012-03-22 15:07:42
Ctime : 2012-03-22 14:44:53 , 2012-03-22 15:07:42
Directory: /usr/lib/nspluginwrapper
Mtime : 2012-03-22 14:44:53 , 2012-03-22 15:07:42
Ctime : 2012-03-22 14:44:53 , 2012-03-22 15:07:42
Directory: /usr/lib/udev
Mtime : 2012-03-22 14:44:54 , 2012-03-22 15:07:42
Ctime : 2012-03-22 14:44:54 , 2012-03-22 15:07:42
Directory: /usr/lib/libv4l
Mtime : 2012-03-22 14:44:54 , 2012-03-22 15:07:42
Ctime : 2012-03-22 14:44:54 , 2012-03-22 15:07:42
Directory: /usr/lib/nss/unsupported-tools
Mtime : 2012-03-22 14:44:54 , 2012-03-22 15:07:43
Ctime : 2012-03-22 14:44:54 , 2012-03-22 15:07:43
Directory: /usr/sbin
Mtime : 2012-03-22 14:45:02 , 2012-03-22 15:07:51
Ctime : 2012-03-22 14:45:02 , 2012-03-22 15:07:51
Directory: /usr/libexec
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:09:35
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:09:35
Directory: /usr/libexec/mc
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:09:35
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:09:35
Directory: /usr/libexec/pulse
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:09:36
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:09:36
Directory: /usr/libexec/certmonger
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:09:36
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:09:36
Directory: /usr/libexec/openssh
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:09:36
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:09:36
Directory: /usr/libexec/oddjob
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:09:36
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:09:36
Directory: /usr/libexec/getconf
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:09:36
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:09:36
Directory: /usr/libexec/gnome-screensaver
Mtime : 2012-03-22 14:46:54 , 2012-03-22 15:09:37
Ctime : 2012-03-22 14:46:54 , 2012-03-22 15:09:37
Directory: /usr/libexec/awk
Mtime : 2012-03-22 14:46:54 , 2012-03-22 15:09:37
Ctime : 2012-03-22 14:46:54 , 2012-03-22 15:09:37
Directory: /usr/libexec/gnome-applets
Mtime : 2012-03-22 14:46:54 , 2012-03-22 15:09:37
Ctime : 2012-03-22 14:46:54 , 2012-03-22 15:09:37
Directory: /usr/libexec/systemtap
Mtime : 2012-03-22 14:46:54 , 2012-03-22 15:09:37
Ctime : 2012-03-22 14:46:54 , 2012-03-22 15:09:37
Directory: /usr/libexec/sssd
Mtime : 2012-03-22 14:46:54 , 2012-03-22 15:09:37
Ctime : 2012-03-22 14:46:54 , 2012-03-22 15:09:37
Directory: /usr/libexec/gstreamer-0.10
Mtime : 2012-03-22 14:46:55 , 2012-03-22 15:09:37
Ctime : 2012-03-22 14:46:55 , 2012-03-22 15:09:37
Directory: /usr/libexec/utempter
Mtime : 2012-03-22 14:46:55 , 2012-03-22 15:09:37
Ctime : 2012-03-22 14:46:55 , 2012-03-22 15:09:37
Directory: /usr/libexec/polkit-1
Mtime : 2012-03-22 14:46:55 , 2012-03-22 15:09:38
Ctime : 2012-03-22 14:46:55 , 2012-03-22 15:09:38
Directory: /usr/bin
Mtime : 2012-03-22 14:47:42 , 2012-03-22 15:10:24
Ctime : 2012-03-22 14:47:42 , 2012-03-22 15:10:24
Directory: /sbin
Mtime : 2012-03-22 14:47:49 , 2012-03-22 15:10:31
Ctime : 2012-03-22 14:47:49 , 2012-03-22 15:10:31
Directory: /lib
Mtime : 2012-03-22 14:47:52 , 2012-03-22 15:10:34
Ctime : 2012-03-22 14:47:52 , 2012-03-22 15:10:34
Directory: /lib/dbus-1
Mtime : 2012-03-22 14:47:54 , 2012-03-22 15:10:36
Ctime : 2012-03-22 14:47:54 , 2012-03-22 15:10:36
Directory: /lib/udev
Mtime : 2012-03-22 14:47:54 , 2012-03-22 15:10:37
Ctime : 2012-03-22 14:47:54 , 2012-03-22 15:10:37
Directory: /lib/security/pam_krb5
Mtime : 2012-03-22 14:47:55 , 2012-03-22 15:10:37
Ctime : 2012-03-22 14:47:55 , 2012-03-22 15:10:37
Directory: /bin
Mtime : 2012-03-22 14:48:03 , 2012-03-22 15:10:45
Ctime : 2012-03-22 14:48:03 , 2012-03-22 15:10:45
--[root at linux ~]# aide --check
AIDE found differences between database and filesystem!!
Start timestamp: 2012-03-22 15:20:45
Summary:
Total number of files: 87385
Added files: 0
Removed files: 0
Changed files: 46
---------------------------------------------------
Changed files:
---------------------------------------------------
changed: /usr/lib
changed: /usr/lib/pm-utils/bin
changed: /usr/lib/sa
changed: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib
changed: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib/i386/jli
changed: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/bin
changed: /usr/lib/perl5/CORE
changed: /usr/lib/gettext
changed: /usr/lib/gnome-session/helpers
changed: /usr/lib/firefox
changed: /usr/lib/anaconda-runtime
changed: /usr/lib/anaconda-runtime/loader
changed: /usr/lib/vte
changed: /usr/lib/libgphoto2
changed: /usr/lib/sse2
changed: /usr/lib/cups/driver
changed: /usr/lib/cups/filter
changed: /usr/lib/festival/etc
changed: /usr/lib/xulrunner-2
changed: /usr/lib/nspluginwrapper
changed: /usr/lib/udev
changed: /usr/lib/libv4l
changed: /usr/lib/nss/unsupported-tools
changed: /usr/sbin
changed: /usr/libexec
changed: /usr/libexec/mc
changed: /usr/libexec/pulse
changed: /usr/libexec/certmonger
changed: /usr/libexec/openssh
changed: /usr/libexec/oddjob
changed: /usr/libexec/getconf
changed: /usr/libexec/gnome-screensaver
changed: /usr/libexec/awk
changed: /usr/libexec/gnome-applets
changed: /usr/libexec/systemtap
changed: /usr/libexec/sssd
changed: /usr/libexec/gstreamer-0.10
changed: /usr/libexec/utempter
changed: /usr/libexec/polkit-1
changed: /usr/bin
changed: /sbin
changed: /lib
changed: /lib/dbus-1
changed: /lib/udev
changed: /lib/security/pam_krb5
changed: /bin
--------------------------------------------------
Detailed information about changes:
---------------------------------------------------
Directory: /usr/lib
Mtime : 2012-03-22 14:44:18 , 2012-03-22 15:11:41
Ctime : 2012-03-22 14:44:18 , 2012-03-22 15:11:41
Directory: /usr/lib/pm-utils/bin
Mtime : 2012-03-22 14:44:18 , 2012-03-22 15:11:41
Ctime : 2012-03-22 14:44:18 , 2012-03-22 15:11:41
Directory: /usr/lib/sa
Mtime : 2012-03-22 14:44:18 , 2012-03-22 15:11:41
Ctime : 2012-03-22 14:44:18 , 2012-03-22 15:11:41
Directory: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib
Mtime : 2012-03-22 14:44:20 , 2012-03-22 15:11:44
Ctime : 2012-03-22 14:44:20 , 2012-03-22 15:11:44
Directory: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/lib/i386/jli
Mtime : 2012-03-22 14:44:23 , 2012-03-22 15:11:46
Ctime : 2012-03-22 14:44:23 , 2012-03-22 15:11:46
Directory: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0/jre/bin
Mtime : 2012-03-22 14:44:24 , 2012-03-22 15:11:47
Ctime : 2012-03-22 14:44:24 , 2012-03-22 15:11:47
Directory: /usr/lib/perl5/CORE
Mtime : 2012-03-22 14:44:27 , 2012-03-22 15:11:50
Ctime : 2012-03-22 14:44:27 , 2012-03-22 15:11:50
Directory: /usr/lib/gettext
Mtime : 2012-03-22 14:44:28 , 2012-03-22 15:11:51
Ctime : 2012-03-22 14:44:28 , 2012-03-22 15:11:51
Directory: /usr/lib/gnome-session/helpers
Mtime : 2012-03-22 14:44:28 , 2012-03-22 15:11:51
Ctime : 2012-03-22 14:44:28 , 2012-03-22 15:11:51
Directory: /usr/lib/firefox
Mtime : 2012-03-22 14:44:28 , 2012-03-22 15:11:51
Ctime : 2012-03-22 14:44:28 , 2012-03-22 15:11:51
Directory: /usr/lib/anaconda-runtime
Mtime : 2012-03-22 14:44:30 , 2012-03-22 15:11:52
Ctime : 2012-03-22 14:44:30 , 2012-03-22 15:11:52
Directory: /usr/lib/anaconda-runtime/loader
Mtime : 2012-03-22 14:44:30 , 2012-03-22 15:11:53
Ctime : 2012-03-22 14:44:30 , 2012-03-22 15:11:53
Directory: /usr/lib/vte
Mtime : 2012-03-22 14:44:47 , 2012-03-22 15:12:10
Ctime : 2012-03-22 14:44:47 , 2012-03-22 15:12:10
Directory: /usr/lib/libgphoto2
Mtime : 2012-03-22 14:44:47 , 2012-03-22 15:12:10
Ctime : 2012-03-22 14:44:47 , 2012-03-22 15:12:10
Directory: /usr/lib/sse2
Mtime : 2012-03-22 14:44:48 , 2012-03-22 15:12:11
Ctime : 2012-03-22 14:44:48 , 2012-03-22 15:12:11
Directory: /usr/lib/cups/driver
Mtime : 2012-03-22 14:44:48 , 2012-03-22 15:12:11
Ctime : 2012-03-22 14:44:48 , 2012-03-22 15:12:11
Directory: /usr/lib/cups/filter
Mtime : 2012-03-22 14:44:49 , 2012-03-22 15:12:12
Ctime : 2012-03-22 14:44:49 , 2012-03-22 15:12:12
Directory: /usr/lib/festival/etc
Mtime : 2012-03-22 14:44:49 , 2012-03-22 15:12:12
Ctime : 2012-03-22 14:44:49 , 2012-03-22 15:12:12
Directory: /usr/lib/xulrunner-2
Mtime : 2012-03-22 14:44:53 , 2012-03-22 15:12:16
Ctime : 2012-03-22 14:44:53 , 2012-03-22 15:12:16
Directory: /usr/lib/nspluginwrapper
Mtime : 2012-03-22 14:44:53 , 2012-03-22 15:12:16
Ctime : 2012-03-22 14:44:53 , 2012-03-22 15:12:16
Directory: /usr/lib/udev
Mtime : 2012-03-22 14:44:54 , 2012-03-22 15:12:17
Ctime : 2012-03-22 14:44:54 , 2012-03-22 15:12:17
Directory: /usr/lib/libv4l
Mtime : 2012-03-22 14:44:54 , 2012-03-22 15:12:17
Ctime : 2012-03-22 14:44:54 , 2012-03-22 15:12:17
Directory: /usr/lib/nss/unsupported-tools
Mtime : 2012-03-22 14:44:54 , 2012-03-22 15:12:17
Ctime : 2012-03-22 14:44:54 , 2012-03-22 15:12:17
Directory: /usr/sbin
Mtime : 2012-03-22 14:45:02 , 2012-03-22 15:12:25
Ctime : 2012-03-22 14:45:02 , 2012-03-22 15:12:25
Directory: /usr/libexec
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:14:17
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:14:17
Directory: /usr/libexec/mc
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:14:17
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:14:17
Directory: /usr/libexec/pulse
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:14:17
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:14:17
Directory: /usr/libexec/certmonger
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:14:18
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:14:18
Directory: /usr/libexec/openssh
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:14:18
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:14:18
Directory: /usr/libexec/oddjob
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:14:18
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:14:18
Directory: /usr/libexec/getconf
Mtime : 2012-03-22 14:46:53 , 2012-03-22 15:14:18
Ctime : 2012-03-22 14:46:53 , 2012-03-22 15:14:18
Directory: /usr/libexec/gnome-screensaver
Mtime : 2012-03-22 14:46:54 , 2012-03-22 15:14:18
Ctime : 2012-03-22 14:46:54 , 2012-03-22 15:14:18
Directory: /usr/libexec/awk
Mtime : 2012-03-22 14:46:54 , 2012-03-22 15:14:18
Ctime : 2012-03-22 14:46:54 , 2012-03-22 15:14:18
Directory: /usr/libexec/gnome-applets
Mtime : 2012-03-22 14:46:54 , 2012-03-22 15:14:18
Ctime : 2012-03-22 14:46:54 , 2012-03-22 15:14:18
Directory: /usr/libexec/systemtap
Mtime : 2012-03-22 14:46:54 , 2012-03-22 15:14:18
Ctime : 2012-03-22 14:46:54 , 2012-03-22 15:14:18
Directory: /usr/libexec/sssd
Mtime : 2012-03-22 14:46:54 , 2012-03-22 15:14:19
Ctime : 2012-03-22 14:46:54 , 2012-03-22 15:14:19
Directory: /usr/libexec/gstreamer-0.10
Mtime : 2012-03-22 14:46:55 , 2012-03-22 15:14:19
Ctime : 2012-03-22 14:46:55 , 2012-03-22 15:14:19
Directory: /usr/libexec/utempter
Mtime : 2012-03-22 14:46:55 , 2012-03-22 15:14:19
Ctime : 2012-03-22 14:46:55 , 2012-03-22 15:14:19
Directory: /usr/libexec/polkit-1
Mtime : 2012-03-22 14:46:55 , 2012-03-22 15:14:19
Ctime : 2012-03-22 14:46:55 , 2012-03-22 15:14:19
Directory: /usr/bin
Mtime : 2012-03-22 14:47:42 , 2012-03-22 15:15:07
Ctime : 2012-03-22 14:47:42 , 2012-03-22 15:15:07
Directory: /sbin
Mtime : 2012-03-22 14:47:49 , 2012-03-22 15:15:14
Ctime : 2012-03-22 14:47:49 , 2012-03-22 15:15:14
Directory: /lib
Mtime : 2012-03-22 14:47:52 , 2012-03-22 15:15:16
Ctime : 2012-03-22 14:47:52 , 2012-03-22 15:15:16
Directory: /lib/dbus-1
Mtime : 2012-03-22 14:47:54 , 2012-03-22 15:15:18
Ctime : 2012-03-22 14:47:54 , 2012-03-22 15:15:18
Directory: /lib/udev
Mtime : 2012-03-22 14:47:54 , 2012-03-22 15:15:19
Ctime : 2012-03-22 14:47:54 , 2012-03-22 15:15:19
Directory: /lib/security/pam_krb5
Mtime : 2012-03-22 14:47:55 , 2012-03-22 15:15:19
Ctime : 2012-03-22 14:47:55 , 2012-03-22 15:15:19
Directory: /bin
Mtime : 2012-03-22 14:48:03 , 2012-03-22 15:15:27
Ctime : 2012-03-22 14:48:03 , 2012-03-22 15:15:27
--[root at linux ~]#
Any help with this would be greatly appreciated. Thanks, all! :-)
--Rich Dupuy
State of Louisiana
-Division of Administration
-Office of Computing Services
More information about the Aide
mailing list