Why does file's inode change?

Andreas Dilger adilger at clusterfs.com
Wed Mar 8 18:54:26 UTC 2006

On Mar 08, 2006  19:40 +0100, Stefan Drexleri wrote:
> perhaps dump question:
> I'm using ids system and doing file monitoring.
> If any file changed, i see it.
> Recently i saw inode change of /etc/shadow.
> One user was added.
> So what might be reason for inode change of any file? Does inode size grow
> by-and-by? I think not. Or might only reasonable cause be that this file was
> deleted and recreated again?

Many tools will do updates in a new copy of the file and then rename the
new file over the old one.  This ensures that if the program or system
crash during the update that there isn't a partial update to the file
that leaves corruption in the file.

You can verify this by looking at the code, or running "strace useradd"
(or whatever program is being used).

Cheers, Andreas
Andreas Dilger
Principal Software Engineer
Cluster File Systems, Inc.

More information about the Ext3-users mailing list