file watch result help

[LC Bruzenak]

On Mon, 2008-07-21 at 08:39 -0500, LC Bruzenak wrote:
...
> 
> Thank you for the reply, however there was no config change after I
> installed this file.
> The action is happening automatically, since it occurred at 4AM.
> I suspect that the prelink cron job is doing this.

That is definitely the problem - prelink cron job moves file, which
erases the CAP. 
The audit record was adequate in pointing me to the problem.

LCB.

-- 
LC (Lenny) Bruzenak
lenny at magitekltd.com