Conference turris::digital_unix

9218.0. "Why do these files change?" by BIGUN::nessus.cao.dec.com::Mayne (A wretched hive of scum and villainy) Wed Mar 19 1997 00:52

A while back, I hand-built a firewall for a customer (no AltaVista software) on 
top of Digital UNIX 4.0A with C2 turned on. We use Tripwire to detect any file 
changes, and recently it came up with the following which I can't explain. 
(Tripwire says "changed": if more details on the change are required, please say 
so.)

-rwx------ root            0 Mar  5 12:01:37 1997 /etc/sia/siainitgood
-rw-r--r-- root         2386 Mar  5 12:01:36 1997 /etc/sia/OSFC2_matrix.conf
lrwxrwxrwx root           17 Mar  5 12:01:36 1997 /etc/sia/matrix.conf
-rwxr-xr-x bin          3072 Mar  5 12:01:15 1997 /etc/dec_hw_db
-rwxr-xr-x bin          3072 Mar  5 12:01:15 1997 /etc/dec_hw_db.bak
-rw-r--r-- root           63 Mar  5 12:01:40 1997 /etc/motd

It's a reasonable guess that these changed at boot time, given that /etc/motd is 
there at about the same time. Why do the others get changed?

-rw-rw-r-- auth        16384 Mar  6 11:43:13 1997 /etc/auth/system/ttys.db
-rw-rw---- auth        16384 Mar  6 11:43:13 1997 /tcb/files/auth.db
-rwxr-xr-x bin           808 Mar  9 23:55:32 1997 /var/adm/sendmail/sendmail.st

These have changed since boot time. ttys.db and auth.db at the same time: 
what would do this? What is sendmail.st used for?

PJDM

    sendmail.st is the sendmail status file. It changes continually.

Any knowledge about the others?

PJDM