On Mar 08, 2006 19:40 +0100, Stefan Drexleri wrote: > perhaps dump question: > > I'm using ids system and doing file monitoring. > If any file changed, i see it. > Recently i saw inode change of /etc/shadow. > One user was added. > > So what might be reason for inode change of any file? Does inode size grow > by-and-by? I think not. Or might only reasonable cause be that this file was > deleted and recreated again? Many tools will do updates in a new copy of the file and then rename the new file over the old one. This ensures that if the program or system crash during the update that there isn't a partial update to the file that leaves corruption in the file. You can verify this by looking at the code, or running "strace useradd" (or whatever program is being used). Cheers, Andreas -- Andreas Dilger Principal Software Engineer Cluster File Systems, Inc. _______________________________________________ Ext3-users@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/ext3-users
