[Tripwire-dev] Tripwire reporting many non-modified files as modified.

[Erik E. <ee...@pr...>]

Hi.

We've got Tripwire running on some servers here.  Largly, it's working
as expected and we're happy with it.  However, there is one problem that
keeps occuring.

Every now and then (I can't see a pattern in when it is happening),
tripwire will report some 12000 objects modified on one of the servers
(about 13000 objects in total).  The objects are our "bin-dirs";
/usr/lib, /usr/bin, /usr/sbin and so on.  These files has not been
modified.

I update the database and everything works fine again for a couple of
days/perhaps a week.  That is, until it happens again.

Any pointers as to what makes this happen?

System: RedHat 7.2, Tripwire 2.3.1

Thanks in advance,

Erik Enge