[Aide] aide reports changed user.crtime_usec

[Marc Haber]

Hi,

this is what my aide says about some systemd.journal files:

|f   ...    . .X .: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/system.journal
|f   ...    . .X .: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/user-1001.journal
|f++++++++++++++++: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/user-1001 at 1b186da42350481f889a74c7ec094675-000000000001fbab-00059
|f   ...    . .X .: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/user-1884.journal
|f < ...    . .. .: /var/log/syslog/named
|
|---------------------------------------------------
|Detailed information about changes:
|---------------------------------------------------
|
|File: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/system.journal
|  XAttrs   : num=1                            | num=1
|             [1] user.crtime_usec <=> y5jlySS | [1] user.crtime_usec <=> JpmbiC+
|             QBQA=                            | QBQA=
|
|File: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/user-1001.journal
|  XAttrs   : num=1                            | num=1
|             [1] user.crtime_usec <=> BUfmySS | [1] user.crtime_usec <=> lTaciC+
|             QBQA=                            | QBQA=
|
|File: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/user-1884.journal
|  XAttrs   : num=1                            | num=1
|             [1] user.crtime_usec <=> kynnySS | [1] user.crtime_usec <=> ieeciC+
|             QBQA=                            | QBQA=

What is that? how would I turn it off? This is a sporadic issue, I have seen it
once, and just on a single machine.

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421