Ext3 users - Mar 2006 - Why does file's inode change?

Hi,

perhaps dump question:

I'm using ids system and doing file monitoring.
If any file changed, i see it.
Recently i saw inode change of /etc/shadow.
One user was added.

So what might be reason for inode change of any file? Does inode size grow
by-and-by? I think not. Or might only reasonable cause be that this file was
deleted and recreated again?

regards
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://listman.redhat.com/archives/ext3-users/attachments/20060308/cb3c36e0/attachment.htm>

On Mar 08, 2006  19:40 +0100, Stefan Drexleri wrote:
> perhaps dump question:
> 
> I'm using ids system and doing file monitoring.
> If any file changed, i see it.
> Recently i saw inode change of /etc/shadow.
> One user was added.
> 
> So what might be reason for inode change of any file? Does inode size grow
> by-and-by? I think not. Or might only reasonable cause be that this file
was
> deleted and recreated again?
Many tools will do updates in a new copy of the file and then rename the
new file over the old one.  This ensures that if the program or system
crash during the update that there isn't a partial update to the file
that leaves corruption in the file.

You can verify this by looking at the code, or running "strace
useradd"
(or whatever program is being used).

Cheers, Andreas
--
Andreas Dilger
Principal Software Engineer
Cluster File Systems, Inc.