On Wed 05 May 2021 at 03:11:53 (+0200), Emanuel Berg wrote:
> Kushal Kumaran wrote:
>
> > The manpage at
> > https://manpages.debian.org/buster/iwatch/iwatch.1.en.html
> > shows log output similar to what you see. Check your iwatch
> > configuration and see what it is doing.
>
> Thanks, but I've never heard of iwatch, so I haven't mucked
> around with its config file. But OK, here it is
[ … configuration … ]
> Does that say anything to you?
It looks reasonable for determining whether your system files are
being interfered with. But you just showed one example from the
log, which was for the /etc/.pwd.lock lockfile. I assume you don't
have 2757 of these but, rather, the names of an assortment of files.
So—you're interfering with the system, by installing, removing and
reconfiguring software; people are changing their passwords, and
so on.
You might be able to correlate the timestamps of some of the changes
being made with those in logs like /var/log/apt/history*, which
shows software upgrades.
/etc/.pwd.lock is probably not a good example, as it's opened for
writing but not written to. On my system, it's the 3rd-oldest
file modification in /etc (after /etc/{shells,environment} and
before /etc/{adduser.conf,machine-id}).
BTW,
$ aptitude why iwatch
or
$ zgrep -B1 iwatch /var/log/apt/history.log*
might help determine why you installed iwatch.
Cheers,
David.
