Hi I am investigating tripwire and have stumbled upon something which i am unsure about. in a tripwire report generated after i modified hosts.deny to include an extra # I noticed the inode number changed from 6969 to 6915. I would like to know why this happened. I know inodes are records which store data about where data is stored on the file system, but would like to know why this number changed for a simple # being inserted.
Standard behavior for text editors is to rename the original file to a temporary name before writing out changes, so if there is a problem (such as out of disk space) you don't lose the file entirely. Thus the file gets a new inode number. If the editor is configured to leave the original as a backup file, you'll find the backup file has the original inode number; if not, then the backup will have been deleted after the new file was successfully written.