Currently monit cannot distinguish the individual timestamps for "changed timestamp" of a file. I found out that our backup software changes the "ctime" of /etc/passwd if that file was backed up (probably because the software tried to reset the atime stamp). Thus I get "/etc/passwd changed" every time the file was backed up.
Wouldn't it be nice to allow individual test for each timestamp? On Linux I have:
File: `/etc/passwd' Size: 1513 Blocks: 8 IO Block: 4096 regular file Device: fd00h/64768d Inode: 17133 Links: 1 Access: (0644/-rw-r--r--) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2015-02-20 03:46:04.000000000 +0100 Modify: 2015-02-12 08:23:14.000000000 +0100 Change: 2015-02-20 03:45:21.000000000 +0100 Birth: -
Regards, Ulrich Windl