Hi All,

I'm running Mandrake 9.0 on my web server/e-mail server/firewall and MSEC is sending me reports every night telling me what's going on. The thing I find confusing is that I keep getting reports like this:-

Security Warning: These files belonging to packages have changed of status on the system : - No longer modified : /usr/include/c++/3.2/bits/istream.tcc

The thing is, this file has never been modified and it hasn't been modified back. What does it mean by "no longer modified"?

It'll tell me one night that a file has been modified and then the next night it'll tell me that it is no longer modified. With all this "crying wolf" how do I, as a sysadmin, tell when something has really been modified?

Matt