|
Each entity on a Linux FS is represented as a file, and each file is linked to an inode (and each inode is referenced in an index). The inode contains information about the file: have a look with "stat /etc/mtab". /etc/mtab represents all filesystems mounted at the moment, and the contents will be refreshed whenever a filesystem is (u)mounted. So, if the contents don't change, the file is deleted and recreated, which (AFAIK per definition) uses another inode.
I't s good to track changes in /etc, but changes on this particular file alone don't spell thunder and lightning.
If you want to know more, read your systems info pages for stat, touch and shred. Else look up articles on file integrity, Securityfocus.com has some.
|
