[Aide] aide reports changed user.crtime_usec

[Marc Haber]

ping?

Greetings
Marc

On Fri, Aug 16, 2019 at 08:38:04PM +0200, Marc Haber wrote:
> From: Marc Haber <mh+aide at zugschlus.de>
> Subject: aide reports changed user.crtime_usec
> To: aide at ipi.fi
> Date: Fri, 16 Aug 2019 20:38:04 +0200
> User-Agent: Mutt/1.10.1 (2018-07-13)
> 
> Hi,
> 
> this is what my aide says about some systemd.journal files:
> 
> |f   ...    . .X .: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/system.journal
> |f   ...    . .X .: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/user-1001.journal
> |f++++++++++++++++: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/user-1001 at 1b186da42350481f889a74c7ec094675-000000000001fbab-00059
> |f   ...    . .X .: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/user-1884.journal
> |f < ...    . .. .: /var/log/syslog/named
> |
> |---------------------------------------------------
> |Detailed information about changes:
> |---------------------------------------------------
> |
> |File: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/system.journal
> |  XAttrs   : num=1                            | num=1
> |             [1] user.crtime_usec <=> y5jlySS | [1] user.crtime_usec <=> JpmbiC+
> |             QBQA=                            | QBQA=
> |
> |File: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/user-1001.journal
> |  XAttrs   : num=1                            | num=1
> |             [1] user.crtime_usec <=> BUfmySS | [1] user.crtime_usec <=> lTaciC+
> |             QBQA=                            | QBQA=
> |
> |File: /var/log/journal/eb13c9a79d8a60ae810ec0755d4c4c57/user-1884.journal
> |  XAttrs   : num=1                            | num=1
> |             [1] user.crtime_usec <=> kynnySS | [1] user.crtime_usec <=> ieeciC+
> |             QBQA=                            | QBQA=
> 
> What is that? how would I turn it off? This is a sporadic issue, I have seen it
> once, and just on a single machine.
> 
> Greetings
> Marc
> 
> -- 
> -----------------------------------------------------------------------------
> Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
> Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
> Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Leimen, Germany    |  lose things."    Winona Ryder | Fon: *49 6224 1600402
Nordisch by Nature |  How to make an American Quilt | Fax: *49 6224 1600421