I am getting repeated warnings by rkhunter about /usr/bin

classic Classic list List threaded Threaded
4 messages Options
Reply | Threaded
Open this post in threaded view
|

I am getting repeated warnings by rkhunter about /usr/bin

Stakanov Schufter
Something I did not see? Or has there been an update?
I have done a --propupd but this has not real an effect. I am getting
following warning (the first before running --propupd, the second today, with
no other update)

a) Warning: The file properties have changed:
         File: /usr/bin/file
         Current inode: 661139    Stored inode: 661182

I did run --propupd (thought it was just an effect of an update) but today:

Warning: The file properties have changed:
         File: /usr/bin/perl
         Current inode: 660485    Stored inode: 660486

Can run VLC as external player in mozilla give that warning?



--
To unsubscribe, e-mail: [hidden email]
To contact the owner, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: I am getting repeated warnings by rkhunter about /usr/bin

Peter Suetterlin
stakanov wrote:

> Something I did not see? Or has there been an update?
> I have done a --propupd but this has not real an effect. I am getting
> following warning (the first before running --propupd, the second today, with
> no other update)
>
> a) Warning: The file properties have changed:
>          File: /usr/bin/file
>          Current inode: 661139    Stored inode: 661182
>
> I did run --propupd (thought it was just an effect of an update) but today:
>
> Warning: The file properties have changed:
>          File: /usr/bin/perl
>          Current inode: 660485    Stored inode: 660486

Uh.  Can it be sector reallocation of the disk, or some automatic filesystem
cleaning?

--
To unsubscribe, e-mail: [hidden email]
To contact the owner, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: I am getting repeated warnings by rkhunter about /usr/bin

Stakanov Schufter
In data mercoledì 29 novembre 2017 17:54:22 CET, Peter Suetterlin ha scritto:

> stakanov wrote:
> > Something I did not see? Or has there been an update?
> > I have done a --propupd but this has not real an effect. I am getting
> > following warning (the first before running --propupd, the second today,
> > with no other update)
> >
> > a) Warning: The file properties have changed:
> >          File: /usr/bin/file
> >          Current inode: 661139    Stored inode: 661182
> >
> > I did run --propupd (thought it was just an effect of an update) but
> > today:
> >
> > Warning: The file properties have changed:
> >          File: /usr/bin/perl
> >          Current inode: 660485    Stored inode: 660486
>
> Uh.  Can it be sector reallocation of the disk, or some automatic filesystem
> cleaning?
It is an ssd and EXT4. Would this correspond? fstrim in automatic? And then,
why would this happen now and not before.
Could an automatic shutdown for temperature be the reason?
But twice in few days difference? I had only one shutdown AFAIK.
The system is /boot and the rest on ecrypted LVM. All partitions EXT4...
SSD Samsung 850 pro
maybe I should run a check on ram...





--
To unsubscribe, e-mail: [hidden email]
To contact the owner, e-mail: [hidden email]

Reply | Threaded
Open this post in threaded view
|

Re: I am getting repeated warnings by rkhunter about /usr/bin

Peter Suetterlin
stakanov wrote:
> In data mercoledì 29 novembre 2017 17:54:22 CET, Peter Suetterlin ha scritto:
> > stakanov wrote:

> > > Warning: The file properties have changed:
> > >          File: /usr/bin/perl
> > >          Current inode: 660485    Stored inode: 660486
> >

> > Uh.  Can it be sector reallocation of the disk, or some automatic filesystem
> > cleaning?

> It is an ssd and EXT4. Would this correspond? fstrim in automatic? And then,
> why would this happen now and not before.

No real idea - was just a guess.

> Could an automatic shutdown for temperature be the reason?

A clean shutdown rather not, I'd say.  Have you checked the log for fsck
messages during boot?

> But twice in few days difference? I had only one shutdown AFAIK.
> The system is /boot and the rest on ecrypted LVM. All partitions EXT4...
> SSD Samsung 850 pro

Have those, too - so far very reliable.  So I'm out (of ideas...)

--
To unsubscribe, e-mail: [hidden email]
To contact the owner, e-mail: [hidden email]