[Aide] Welcome to the "Aide" mailing list

[Peter McInerney]

we had something similar on our systems, prelink was causing files scanned to have their times updated thus making the scans almost useless, we worked around this by disabling prelink on our linux servers (as there has been no benefit in leaving it on)

on our redhat systems, it was a case of changing /etc/sysconfig/prelink

PRELINKING=no

and then finally a `prelink -a`

once this was completed, we were able to succesfully generate and then complete an aide check without any changes being noticed


-----Original Message-----
From: aide-bounces at cs.tut.fi [mailto:aide-bounces at cs.tut.fi] On Behalf Of Richard van den Berg
Sent: Friday, 23 March 2012 5:22 PM
To: Aide user mailinglist
Cc: aide at cs.tut.fi
Subject: Re: [Aide] Welcome to the "Aide" mailing list

On 23 mrt. 2012, at 05:49, Marek Dohojda <chrobry at gmail.com> wrote:

> I am running AIDE 0.14 on centos from base repositories.  everything is working fine till I run check.   what I did to test was to run touch /bin/ls.  then I run aide --check. After it finished it updated time stamp on the /bin directory itself.  to ensure this is a problem, I rerun this with same results.  I tied another directory and different server with same results.  I am sure I am missing something stupid, but could someone please me a hint?

Aide does not change the ctime or mtime of anything it scans. Only the atime which is not checked or reported by aide. There must be another mechanism on your OS responsible for this. 

Richard
_______________________________________________
Aide mailing list
Aide at cs.tut.fi
https://mailman.cs.tut.fi/mailman/listinfo/aide

______________________________________________________
    CONFIDENTIALITY NOTICE    
This electronic mail message, including any and/or all attachments, is for the sole use of the intended recipient(s), and may contain confidential and/or privileged information, pertaining to business conducted under the direction and supervision of the sending organization. All electronic mail messages, which may have been established as expressed views and/or opinions (stated either within the electronic mail message or any of its attachments), are left to the sole responsibility of that of the sender, and are not necessarily attributed to the sending organization. Unauthorized interception, review, use, disclosure or distribution of any such information contained within this electronic mail message and/or its attachment(s), is (are) strictly prohibited. If you are not the intended recipient, please contact the sender by replying to this electronic mail message, along with the destruction all copies of the original electronic mail message (along with any attachments).
______________________________________________________