On Fri, Sep 21, 2007 at 07:01:33AM +0200, Andreas Tille wrote: > On Sun, 16 Sep 2007, Marc Haber wrote: > > By default, this only works through one rotation of the logs, and > > starting with the second rotation, the changes are going to be > > reported _until_ you copy the newly generated databases to the old > > ones if no changes were found. > > > > Appropriate settings in /etc/default/aide would be > > COMMAND=update > > COPYNEWDB=ifnochange > > > > Let me know if this helps. > > Not really. I have now > > # grep "^CO*" /etc/default/aide > COMMAND=update > COPYNEWDB=ifnochange > > but ... > > --------------------------------------------------- > Added files: > --------------------------------------------------- > > added: /var/log/exim4/mainlog.2.gz > > --------------------------------------------------- > Removed files: > --------------------------------------------------- > > removed: /var/log/exim4/mainlog.10.gz > removed: /var/log/daemon.log.6.gz > removed: /var/log/syslog.6.gz > > --------------------------------------------------- > Changed files: > --------------------------------------------------- > > changed: /var/log/exim4/mainlog > changed: /var/log/exim4/mainlog.1 > changed: /var/log/syslog > changed: /var/log/daemon.log > changed: /var/log/zope2.9/default/Z2.log > > > > So I think this problem is not yet solved. Or did I missed something?
In a previous run, aide detected changes (most probably the zope log file), and thus the newly generated database was not copied over the old one. After the next log rotation, the log-related rules didn't apply any more and you got the report quoted above. As a rule, if you once get a report that shows changes, you'll get all log reported as changed the next day if you don't interfere manually. Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 3221 2323190 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
