Each time aide is run with either the –check or –update option, it always detects differences between the database and the filesystem. Specifically, the mtime and ctime on certain directories:
# aide --check AIDE found differences between database and filesystem!! Start timestamp: 2014-01-05 08:03:47 Summary: Total number of files: 39240 Added files: 0 Removed files: 0 Changed files: 20 --------------------------------------------------- Changed files: --------------------------------------------------- changed: /usr/sbin changed: /usr/libexec changed: /usr/libexec/gcc/x86_64-redhat-linux/4.4.4 changed: /usr/libexec/getconf changed: /usr/libexec/polkit-1 changed: /usr/libexec/utempter changed: /usr/libexec/awk changed: /usr/bin changed: /usr/lib64 changed: /usr/lib64/pm-utils/bin changed: /usr/lib64/nss/unsupported-tools changed: /usr/lib64/sa changed: /usr/lib64/perl5/CORE changed: /root changed: /root/.viminfo changed: /lib/udev changed: /bin changed: /lib64 changed: /lib64/dbus-1 changed: /sbin -------------------------------------------------- Detailed information about changes: --------------------------------------------------- Directory: /usr/sbin Mtime : 2014-01-05 08:00:49 , 2014-01-05 08:01:20 Ctime : 2014-01-05 08:00:49 , 2014-01-05 08:01:20 Directory: /usr/libexec Mtime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21 Ctime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21 Directory: /usr/libexec/gcc/x86_64-redhat-linux/4.4.4 Mtime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21 Ctime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21 Directory: /usr/libexec/getconf Mtime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21 Ctime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21 Directory: /usr/libexec/polkit-1 Mtime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21 Ctime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21 Directory: /usr/libexec/utempter Mtime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21 Ctime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21 Directory: /usr/libexec/awk Mtime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21 Ctime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21 Directory: /usr/bin Mtime : 2014-01-05 08:00:57 , 2014-01-05 08:01:29 Ctime : 2014-01-05 08:00:57 , 2014-01-05 08:01:29 Directory: /usr/lib64 Mtime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42 Ctime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42 Directory: /usr/lib64/pm-utils/bin Mtime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42 Ctime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42 Directory: /usr/lib64/nss/unsupported-tools Mtime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42 Ctime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42 Directory: /usr/lib64/sa Mtime : 2014-01-05 08:01:10 , 2014-01-05 08:01:43 Ctime : 2014-01-05 08:01:10 , 2014-01-05 08:01:43 Directory: /usr/lib64/perl5/CORE Mtime : 2014-01-05 08:01:10 , 2014-01-05 08:01:44 Ctime : 2014-01-05 08:01:10 , 2014-01-05 08:01:44 Directory: /root Mtime : 2014-01-05 07:59:25 , 2014-01-05 08:03:45 Ctime : 2014-01-05 07:59:25 , 2014-01-05 08:03:45 File: /root/.viminfo Inode : 267392 , 267393 Directory: /lib/udev Mtime : 2014-01-05 08:01:14 , 2014-01-05 08:01:48 Ctime : 2014-01-05 08:01:14 , 2014-01-05 08:01:48 Directory: /bin Mtime : 2014-01-05 08:01:15 , 2014-01-05 08:01:49 Ctime : 2014-01-05 08:01:15 , 2014-01-05 08:01:49 Directory: /lib64 Mtime : 2014-01-05 08:01:16 , 2014-01-05 08:01:50 Ctime : 2014-01-05 08:01:16 , 2014-01-05 08:01:50 Directory: /lib64/dbus-1 Mtime : 2014-01-05 08:01:16 , 2014-01-05 08:01:50 Ctime : 2014-01-05 08:01:16 , 2014-01-05 08:01:50 Directory: /sbin Mtime : 2014-01-05 08:01:18 , 2014-01-05 08:01:52 Ctime : 2014-01-05 08:01:18 , 2014-01-05 08:01:52 |
After each execution of aide, the mtime and ctime on these directories are changed. Hence, aide detects and reports these changes.
This is due to prelinking. If you disable prelinking, then this problem will go away. To disable prelinking, modify the configuration file /etc/sysconfig/prelink. Change “PRELINKING=yes” to “PRELINKING=no“. Then manually run /etc/cron.daily/prelink as root. After updating the aide database, subsequent aide checks will not have this problem.
My System Configuration
- CentOS 6.5 x86 64-bit
- Aide 0.14
# aide --version Aide 0.14 Compiled with the following options: WITH_MMAP WITH_POSIX_ACL WITH_SELINUX WITH_PRELINK WITH_XATTR WITH_LSTAT64 WITH_READDIR64 WITH_ZLIB WITH_GCRYPT WITH_AUDIT CONFIG_FILE = "/etc/aide.conf" |