Hi I am investigating tripwire and have stumbled upon something which i am unsure about. in a tripwire report generated after i modified hosts.deny to include an extra # I noticed the inode number changed from 6969 to 6915. I would like to know why this happened. I know inodes are records which store data about where data is stored on the file system, but would like to know why this number changed for a simple # being inserted.


Standard behavior for text editors is to rename the original file to a temporary name before writing out changes, so if there is a problem (such as out of disk space) you don't lose the file entirely. Thus the file gets a new inode number. If the editor is configured to leave the original as a backup file, you'll find the backup file has the original inode number; if not, then the backup will have been deleted after the new file was successfully written.

  • is there somewhere where I can reference this information. it makes sense but i am not allowed to reference a place such as stackexchange thank you very much :D – Mintuz Mar 5 '11 at 11:47
  • Not offhand; it's a programming best practice, I would expect it to be covered in any book which discusses developing applications. – geekosaur Mar 5 '11 at 12:04
  • 1
    @Mintuz: Depending on the circumstances, when you save editor might either create a new file and rename it into place, or write to the original file. There are up- and downsides to both methods. I know this has been discussed before, either on this site or on Stack Overflow or Super User, though I can't find the thread right now. – Gilles Mar 5 '11 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.