Hi I am investigating tripwire and have stumbled upon something which i am unsure about. in a tripwire report generated after i modified hosts.deny to include an extra # I noticed the inode number changed from 6969 to 6915. I would like to know why this happened. I know inodes are records which store data about where data is stored on the file system, but would like to know why this number changed for a simple # being inserted.

1 Answer 1


Standard behavior for text editors is to rename the original file to a temporary name before writing out changes, so if there is a problem (such as out of disk space) you don't lose the file entirely. Thus the file gets a new inode number. If the editor is configured to leave the original as a backup file, you'll find the backup file has the original inode number; if not, then the backup will have been deleted after the new file was successfully written.

  • is there somewhere where I can reference this information. it makes sense but i am not allowed to reference a place such as stackexchange thank you very much :D
    – Mintuz
    Commented Mar 5, 2011 at 11:47
  • Not offhand; it's a programming best practice, I would expect it to be covered in any book which discusses developing applications.
    – geekosaur
    Commented Mar 5, 2011 at 12:04
  • 1
    @Mintuz: Depending on the circumstances, when you save editor might either create a new file and rename it into place, or write to the original file. There are up- and downsides to both methods. I know this has been discussed before, either on this site or on Stack Overflow or Super User, though I can't find the thread right now. Commented Mar 5, 2011 at 12:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .