Constant /etc/asl/whitelist checksum change

General Discussion of atomic repo and development projects.

Ask for help here with anything else not covered by other forums.
kontiki
Forum User
Forum User
Posts: 7
Joined: Sun Mar 23, 2014 6:56 pm
Location: New York

Constant /etc/asl/whitelist checksum change

Unread post by kontiki »

Hi,

Ever since a recent reboot, I've been getting 550 alerts regarding a changing checksum on /etc/asl/whitelist. Looking at the file, seems like the access time is changing every minute. The content of the file, its size and other properties of the file do not change at all. I also checked the SHA1 sum of the file at intervall: no changes.

This problem is most probably related to another warning, coming from ossec-syscheckd:

>> 2018/01/25 06:45:54 ossec-syscheckd: WARNING: Error opening directory: '/etc/asl/whitelist.483964748': No such file or directory

ossec-syscheckd has also been complaining about yum:

>> 2018/01/24 08:18:40 ossec-syscheckd: WARNING: Error opening directory: '/etc/yum.repos.d/sedYLqvq7': No such file or directory

Looks like these temporary files are created, destroyed and then checked by ossec-syscheckd which cannot find them.

Should I be concerned?

Thanks.
Post Reply