Are there any other files changed or reported similarly?
AFAIK Logwatch doesn't do anything but parse logs for messages to report.
If there's something changed it should come from some app it's reading the logs for.
I'd say verify the contents, after all resolv.conf is ASCII, do a "stat" so you can save the MAC times.
If the next day the M time wasn't changed then this could be either a false positive, or for instance a filesystem integrity check database that wasn't updated, or (when resolv.conf was changed) rpm -V should fail. Like that.
If it isn't any of those, and your filesystem supports it, and if you don't need it to be changed, you could make the file immutable (chattr) and see if anything complains about that.
|