#4 still about inode change time(ctime)

closed
eric gerbier
None
5
2006-08-31
2006-06-30
annie
No

Hi,

I installed afick-2.8-2 on linux servers of our data
center. afick is customized to run on 4:22 every
sunday. But every week, I would get one report from
afick, including the following info:
"changed file : /etc/afick.conf
ctime : Thu Jun 22
15:04:49 2006 Thu Jun 29 00:00:55 2006"

It's obvious that this time displayed in this record
is not afick run time. In fact, I don't make any
action to afick.conf file since afick installed. I
don't know why this record always exists in afick
report. What should I do to advoid reporting this
record on afick run?

Looking forword to any reply!

Thanks in advance,

Annie

Discussion

  • annie
    annie
    2006-06-30

    • assigned_to: nobody --> gerbier
     
  • annie
    annie
    2006-06-30

    • priority: 5 --> 9
     
  • annie
    annie
    2006-06-30

    • priority: 9 --> 5
     
  • eric gerbier
    eric gerbier
    2006-07-04

    • status: open --> pending
     
  • eric gerbier
    eric gerbier
    2006-07-04

    Logged In: YES
    user_id=91641

    How do you run afick ? : are you using the afick_cron shell
    script, or do you write your own script ?

    Does the ctime date change on each run or not ?

     
  • annie
    annie
    2006-07-05

    Logged In: YES
    user_id=1547924

    Thanks for your response.

    Yes, I use afick default afick_cron shell script. Only I
    made a minor change of afick run based on weekly NOT
    default daily.

    My issue is that I set afick run on 5:00 am every Sunday
    and then send me result report. But many reports from
    servers display one line like this "
    changed file : /etc/afick.conf
    ctime : Thu Jun 22 15:04:49 2006 Thu Jun 29
    00:00:55 2006"
    Just only this file: /etc/afick.conf with "ctime" change.
    This ctime date change occurs in many NOT all afick servers
    every week. In addition, ctime change date&time is
    obviouslly not Sunday(afick run date&time). Certainly in
    the meanwhile, I don't make any change to /etc/afick.conf
    file.

    Note: please see attachment for detailed report.

     
  • annie
    annie
    2006-07-05

    • status: pending --> open
     
  • annie
    annie
    2006-07-05

    detailed afick report

     
    Attachments
  • eric gerbier
    eric gerbier
    2006-07-05

    Logged In: YES
    user_id=91641

    You can check if the report is ok with the following command:
    stat /etc/afick.conf
    On my computer, the config file was not changed since last
    update. Is there any cron job running every week on Thusday
    (as seen on 3 computers's reports) ?

    ps : the rule on afick.conf is hard-coded and can not be
    change in config file : the only way is to change afick.pl
    perl code.

     
  • annie
    annie
    2006-07-06

    Logged In: YES
    user_id=1547924

    Hi getbier,

    It looks no problem when I run the following command on
    one of 3 computers:
    "$ stat /etc/afick.conf
    File: `/etc/afick.conf'
    Size: 4879 Blocks: 16 IO Block:
    4096 Regular File
    Device: 6803h/26627d Inode: 36008 Links: 1
    Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid:
    ( 0/ root)
    Access: 2006-07-02 04:22:05.000000000 -0700
    Modify: 2006-06-07 20:45:34.000000000 -0700
    Change: 2006-06-29 00:18:36.000000000 -0700"

    In addition, no other cron job running every Thursday on
    above 3 computers. And ctime change doesn't mean there are
    some changes for config file content. Per your ps, you
    mean there is possible some appication change afick.pl
    perl code on my servers?

    (NOTE: I use default afick_cron, that means every week
    afick run with -u option.)

    In my environment, afick run based on daily on some
    particular servers. But I never get afick.conf ctime
    change report from them. I don't know why?

    Thanks,

     
  • eric gerbier
    eric gerbier
    2006-07-06

    Logged In: YES
    user_id=91641

    hello
    the stat command confirm the afick ctime report, so this is
    not an afick bug :)

    I had another look at your report : for the 3 computers, the
    date change from 22 to 29 june, but the time vary from day
    (15h) to night (0h), so it is not a "classic" cron. Anacron
    can produce this kind of job.

    in my ps : I mean the only way to suppress this warning is
    to patch the perl code : you can not remove it by the
    configuration file. In next release, the rule on afick's
    internal files will be less strict and this warning will not
    appear.

    But meanwhile, it is very strange that this ctime is changed
    : it should not in "normal" config.

     
  • Logged In: NO

    Hi gerbier,

    I really appreciated with your patient guidance.

    I want to confirm whether I couldn't suppress this ctime
    warning info in afick report, only wait the next release
    of afick. When is afick next release?

    Essentially, I have expected that afick would send a mail
    only if changes for monitoring files are detected. But now
    ctime change always occurs on my datacenter all servers.
    So in every week afick report, there was many changes info
    but the majority is only one record with /etc/afick.conf
    ctime change. :)

    In addition, I don't know whether it result from afick
    reinstall. Because I found that when I uninstall with the
    command "rpm -e afick", but afick database files located
    in /var/lib/afick/ still exist. I don't delete them
    manually and then continue reinstall afick with "rpm -ivh
    afick****".

     
  • eric gerbier
    eric gerbier
    2006-07-10

    Logged In: YES
    user_id=91641

    I release today the next version (2.8-3).

    To my mind, your ctime problem should come from your
    uninstall/re-install, because afick_cron run in update mode (-u)

     
  • annie
    annie
    2006-07-14

    Logged In: YES
    user_id=1547924

    Thanks a lot. I would update some servers with the new
    version.

     
  • eric gerbier
    eric gerbier
    2006-08-16

    • status: open --> pending
     
  • Logged In: YES
    user_id=1312539

    This Tracker item was closed automatically by the system. It was
    previously set to a Pending status, and the original submitter
    did not respond within 14 days (the time period specified by
    the administrator of this Tracker).

     
    • status: pending --> closed