Home / server / Questions / 393049
In Process
newbie14
Asked: 2012-05-27 21:30:09 +0800 CST

aide --init show lots of errors

  • 772

I have a brand new centos 6.2 server. The first thing I did is yum -y install aide and then next I did aide --init. Below is a whole lot of errors I got.What does it means must I reinstall it? Or leave it ?

/usr/sbin/prelink: /usr/sbin/lusermod: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/console-kit-daemon: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/NetworkManager: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/rtacct: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/tcpdump: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/dnsmasq: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/getsebool: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/ownership: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/modem-manager: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/pluginviewer: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/sasl2-shared-mechlist: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/ifdhandler: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/mklost+found: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/vpddecode: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/skdump: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/getpcaps: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lpasswd: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/tmpwatch: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/ck-log-system-stop: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/alternatives: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/avahi-daemon: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/dump-acct: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/luseradd: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/nstat: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/efibootmgr: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/sasldblistusers2: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/e2freefrag: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/sa: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lgroupadd: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/ss: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/dmidecode: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/sktest: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/fdformat: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/saslpasswd2: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/selinuxenabled: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/pppstats: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/wpa_supplicant: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/capsh: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/togglesebool: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/kppp: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lgroupmod: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/cracklib-unpacker: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/getcap: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/avcstat: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lnstat: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/filefrag: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lid: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/bonobo-activation-sysconf: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lockdev: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/mcelog: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/cifs.upcall: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/pcscd: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/brctl: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/logrotate: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/wpa_passphrase: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/pppdump: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/lsof: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/ck-log-system-start: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/setcap: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/rtkitctl: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/latencytop: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/wpa_cli: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
/usr/sbin/prelink: /usr/sbin/saned: at least one of file's dependencies has changed since prelinking
Error on exit of prelink child process
linux dependencies intrusion-detection aide

2 Answers

  1. I had the same exact problem after installing a binary that did not use the normal packaging system dependency resolution to properly share libraries. Here are the steps I used to resolve the problem.

    1. First look at the library dependencies for one of the binaries that caused the aide error message. In my case trashapplet:

      for LIB in $(ldd /usr/libexec/trashapplet | awk '{print $3}' | grep '^/' | sort -u); do echo $(dirname $LIB); done | sort -u

    2. Next, make sure each directory used by the binary is configured for processing with prelink in /etc/prelink.conf. Add any missing directory to the /etc/prelink.conf. In my case, this was:

      -l /usr/local/oracle/product/*/lib

    3. Repeat as necessary.

    In my case the binary hijacked the distro's /lib64/libexpat.so.1 library. Because the new library was located outside the normally-prelinked set but overlapped with the existing library, it caused the mis-match at load time no matter how frequently I prelinked.

    • 2

  2. I had this same issue and found the answer through Red Hat (you need an account). Here is what it says:

    The message "at least one of file's dependencies has changed since prelinking" means that one of the libraries that the application depends on (perhaps glibc) has been upgraded since last prelink cron job run (which by default runs every 14 days(PRELINK_FULL_TIME_INTERVAL=14 ). Prelink is only able to verify files if their dependencies haven't changed. As soon as it is reprelinked, the errors will go away.

    Prelinking only really helps when running applications in a workstation type setup where launching and closing the same application over and over is a common operation. Prelinking doesn't really do anything so server loads where a process is loaded into memory and runs for the duration of the server's uptime.

    Prelinking can be disabled by editing /etc/sysconfig/prelink and setting

    PRELINKING=no

    To undo all the prelink information, run the following command as root:

    prelink -ua

    Since the problem was on my server, not a workstation, the fix worked perfectly (disabling prelinking in /etc/sysconfig/prelink and running "prelink -ua"). If you want to continue to prelink, make sure that you have a prelink cron job ... it's usually in /etc/cron.daily/ and should've been installed by default with your system. Also make sure that crond service is running and /etc/crontab (or /etc/anacrontab) is configured to execute /etc/cron.daily/. The cron job keeps your prelinking up-to-date or else you get those error messages.

    • 1