Unusal results between Tripwire and fbackup with a level -0

[Belinda Dermody]

I just loaded tripwire for HPUX 11i on my system and I notice whenever I do a level -0 fbackup on my system (3 times a week) tripwire on the next report (after the backup has completed) tells me that about 3500 files have been modified (I have over 250000 files), and they are all in /sbin /usr/bin /etc/, all system binaries, /usr/local/bin. The date time stamp of all the files are still what they were when the system was built or upgraded.

When I do a level -1 fbackup everything is report fine except for the files that I expect to be modified. -

[James R. Ferguson · Accepted solution]

Hi James:

'fbackup' resets file access timestamps after it copies them. While this preserves the accesstime (atime) it *does* change the inode or "ctime" timestamp.

Changes in permissions, ownership, the modification (mtime) or access (atime) are always reflected in the 'ctime' timestamp.

Regards!

...JRF...

[Belinda Dermody]

James, you did it again at least I think you did (the way I understand your explanation), but I was hoping for something better that I could change to make the report more valid on the full backup days), now I have to get with Tripwire and find out what I can do to bypass this false report when I do a full backup three times a week.

You only have to put up with me for another 15 months and then SS time and I am out of here...