A Zabbix server I am currently started showing an alert like this:
/etc/passwd has been changed on Router
Now, on this Router machine I don't have a history of the passwd file so I cannot see exactly what changed, but what I know is that the time of the alert roughly coincided with this
Router machine being rebooted. As soon as the router came back up, Zabbix started throwing this alert.
ls -l /etc/passwd on the
Router device shows that the last modified timestamp is roughly the same as the time of the reboot.
This could be pure coincidence, but I'd rather double check here since I could not find anything online: can a simple device reboot cause the
/etc/passwd file to be updated (if not in the contents, at least in the timestamp)?