From owner-freebsd-questions@freebsd.org Tue May 31 17:37:04 2016 Return-Path: Delivered-To: freebsd-questions@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 596A4B568CB for ; Tue, 31 May 2016 17:37:04 +0000 (UTC) (envelope-from alexmiroslav@gmail.com) Received: from mail-vk0-x22b.google.com (mail-vk0-x22b.google.com [IPv6:2607:f8b0:400c:c05::22b]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 16F9D19E6 for ; Tue, 31 May 2016 17:37:04 +0000 (UTC) (envelope-from alexmiroslav@gmail.com) Received: by mail-vk0-x22b.google.com with SMTP id a6so63143134vkg.3 for ; Tue, 31 May 2016 10:37:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:date:message-id:subject:from:to; bh=gH24/rapANGNISORMqXQkBN/jaOgnrsa8f6cMgD45qw=; b=CzfTXqX1BtzT3UHMVh0BkrOa6muubsWGGSIrXMapKGsng3lSv+BB5M0vJ5wK8Y9uwW ZKvYDqUQu1n98cldD3B4n7ZxX+VKgYq8/pU0jK6R8hC74E/QMI5O2IiHOfkwXsc/vSn8 KmWNotHCeZBPgTairK4zOKz97xDoa+cUs9QfMPJ414TRgDSwdEJ3kms92ugX5ddcI4gZ 6a2+N55eE8TcIKzQ7oKzB7T8tjf/9zmj5+E6+X/XANcxtl38Kc1X6AQMzVtSkeVJdert zqhvLeOJFHByQWT/HYjRduLLOxWp2KZysvvt2dVygRLr67JSZ0hRAL81VeypMdzRgEfg FO4A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:date:message-id:subject:from:to; bh=gH24/rapANGNISORMqXQkBN/jaOgnrsa8f6cMgD45qw=; b=JZKc2L/x83APN1CpApmzBZps+MnhtgeI02GbYnT40UushAFcBIYwHVpkENppz5jn64 2XJcz29bCQ7OpwdFXncheg3FvBBh1+EWjtWBa7JvKhamDAwQuvwnPzVssEafMBJEh8aY l1wzvT7JmbuPfsd8P1ynJL7gdODZwbanqqQdgCpAlCNo7eb0FsenOSmYc1gm5EyfzpZh bRA57JDKQCyuFJg2g1dxeKBop4LNFR3CZLiL6WLeO+lXA8ed7tPUMzJcIAisiJnSNMl5 W8mQ11uwQrZu28q9WlSz/POwVaYdQU6efovovN79VLaEaDBugtsi62MW69V1MoOg5wB5 DGDg== X-Gm-Message-State: ALyK8tJOjZQp4STdBTvyJU2YNWqD8uO9z8+DNfzKEtBziJQi26eaoCQdqcpHimX++8l8dFZI8R8Ec/icnExpPw== MIME-Version: 1.0 X-Received: by 10.176.2.139 with SMTP id 11mr17716652uah.6.1464716223279; Tue, 31 May 2016 10:37:03 -0700 (PDT) Received: by 10.159.38.194 with HTTP; Tue, 31 May 2016 10:37:03 -0700 (PDT) Date: Tue, 31 May 2016 10:37:03 -0700 Message-ID: Subject: who/what is touching my DNS directory??? From: Aleksandr Miroslav To: freebsd-questions@freebsd.org Content-Type: text/plain; charset=UTF-8 X-Content-Filtered-By: Mailman/MimeDel 2.1.22 X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 31 May 2016 17:37:04 -0000 I'm running nsd for my DNS. My /usr/local/etc/nsd is managed as a git repo. In addition, I have aide running for file integrity detection. Here's the issue I am seeing: Every couple of day, aide tells me that the mtime/ctime on /usr/local/etc/nsd/.git has been updated by a few hours. Nothing else, just the git directory. Nothing inside it is touched, nothing in the nsd directory is touched. I'm pretty sure it is nsd doing this, but I'm not sure why. I'm fairly certain the box has not been hacked, (I think) the box is locked down fairly tightly. How can I verify what is updating the git directory? This box is running 10.3, fwiw. thanks, Alex