I have aide, a file integrity monitor, watching the files on one of my boxes. It recently reported a change to /etc/prelink.cache. I am tempted to think that this file, being a cache, will tend to change without any reason obvious to me. And so it seems to me that I will get lots of false alarms and the only small amount of good it might accomplish is that if I ever have a real intrusion using that file it will provide a small but inconclusive clue. So I am tempted to reconfigure aide to ignore that file. Is this a bad idea? Are changes to this file more predictable than I am supposing? Thanks, Dave
