[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

Re: Why does file's inode change?



On Mar 08, 2006  19:40 +0100, Stefan Drexleri wrote:
> perhaps dump question:
> 
> I'm using ids system and doing file monitoring.
> If any file changed, i see it.
> Recently i saw inode change of /etc/shadow.
> One user was added.
> 
> So what might be reason for inode change of any file? Does inode size grow
> by-and-by? I think not. Or might only reasonable cause be that this file was
> deleted and recreated again?

Many tools will do updates in a new copy of the file and then rename the
new file over the old one.  This ensures that if the program or system
crash during the update that there isn't a partial update to the file
that leaves corruption in the file.

You can verify this by looking at the code, or running "strace useradd"
(or whatever program is being used).

Cheers, Andreas
--
Andreas Dilger
Principal Software Engineer
Cluster File Systems, Inc.


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]