Re: /etc/prelink.cache

On Wed, 2007-10-31 at 08:51 -1000, Dave Burns wrote:
I have aide, a file integrity monitor, watching the files on one of my
boxes. It recently reported a change to /etc/prelink.cache.

I am tempted to think that this file, being a cache, will tend to
change without any reason obvious to me.

And so it seems to me that I will get lots of false alarms and the
only small amount of good it might accomplish is that if I ever have a
real intrusion using that file it will provide a small but
inconclusive clue.

So I am tempted to reconfigure aide to ignore that file. Is this a bad
idea? Are changes to this file more predictable than I am supposing?

There are a number of files that will change depending on system
activity and that's one of them. Lots of the files in /var/log will
also change (messages, dmesg, boot.log, wtmp, you get the idea).

prelink is run once a day via the system crontab and its control file
/etc/cron.daily/prelink. The cache will change if system libraries are
updated via yum/rpm or you build something that adds libraries to the
normal system directories. This is controlled by /etc/prelink.conf.

----------------------------------------------------------------------
- Rick Stevens, Principal Engineer rstevens@xxxxxxxxxxxx -
- CDN Systems, Internap, Inc. http://www.internap.com -
- -
- Time: Nature's way of keeping everything from happening at once. -
----------------------------------------------------------------------

--
fedora-list mailing list
fedora-list@xxxxxxxxxx
To unsubscribe: https://www.redhat.com/mailman/listinfo/fedora-list

Relevant Pages

  • Re: [QUICKLIST 0/4] Arch independent quicklists V2
    ... Sure, that is a minor detail, considering that you'll usually be allocating ... reason to be upset. ... And you want to allocate cache cold pages as well, ... known-zero, cache-hot page into the pagetable quicklists, you still have ...
    (Linux-Kernel)
  • Re: RosAsm Team is Still Making Excuses
    ... | good reason" to dword align byte data. ... as here is a difference between L1 and L2 cache access timing. ... As the CPU itself doesn't direct drive address- and data-bus lines, ...
    (alt.lang.asm)
  • Re: Page Timeout
    ... tested that and it worked but my boss prefers the timeout approach. ... There wouldn't be a reason why testing it with the server ... the Cache property of Response. ... then forgot cache use session time out, in each of your secure pages ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Software Optimization Guide for AMD Family 10h Processors
    ... |>> But part of the reason that I had forgotten them is that I looked at ... I believe you when you say that they support cache ... It's just as cache coherent as a 2 socket Intel chipset. ...
    (comp.arch)
  • Re: follow up to upper lower case differences.
    ... To Google, there is no access to cache, but it's possible that the browser ... Try another Web browser or disable/flush cache. ... Maybe datacentre allocation sniffs your HTTP headers ... I can't think of a reason. ...
    (alt.internet.search-engines)