Constant /etc/asl/whitelist checksum change
Posted: Thu Jan 25, 2018 8:08 am
Hi,
Ever since a recent reboot, I've been getting 550 alerts regarding a changing checksum on /etc/asl/whitelist. Looking at the file, seems like the access time is changing every minute. The content of the file, its size and other properties of the file do not change at all. I also checked the SHA1 sum of the file at intervall: no changes.
This problem is most probably related to another warning, coming from ossec-syscheckd:
>> 2018/01/25 06:45:54 ossec-syscheckd: WARNING: Error opening directory: '/etc/asl/whitelist.483964748': No such file or directory
ossec-syscheckd has also been complaining about yum:
>> 2018/01/24 08:18:40 ossec-syscheckd: WARNING: Error opening directory: '/etc/yum.repos.d/sedYLqvq7': No such file or directory
Looks like these temporary files are created, destroyed and then checked by ossec-syscheckd which cannot find them.
Should I be concerned?
Thanks.
Ever since a recent reboot, I've been getting 550 alerts regarding a changing checksum on /etc/asl/whitelist. Looking at the file, seems like the access time is changing every minute. The content of the file, its size and other properties of the file do not change at all. I also checked the SHA1 sum of the file at intervall: no changes.
This problem is most probably related to another warning, coming from ossec-syscheckd:
>> 2018/01/25 06:45:54 ossec-syscheckd: WARNING: Error opening directory: '/etc/asl/whitelist.483964748': No such file or directory
ossec-syscheckd has also been complaining about yum:
>> 2018/01/24 08:18:40 ossec-syscheckd: WARNING: Error opening directory: '/etc/yum.repos.d/sedYLqvq7': No such file or directory
Looks like these temporary files are created, destroyed and then checked by ossec-syscheckd which cannot find them.
Should I be concerned?
Thanks.