Yes, when NetBackup accesses the file, it changes atime, since it accesses 
it the same as you and I do.  It then resets atime to the value it was 
before it touched it.  However, that changes ctime, since it's seen as an 
attribute change.  Since this is something that hackers do to cover their 
tracks, tripwire would indeed go crazy.

One question is, "For all UNIXs, does changing the CONTENTS of the file 
result in its ctime being changed?"  If the answer's no, then you will be 
missing files on your incremental backups.

At 12:08 PM 3/2/00 -0500, Howard Lapin wrote:
>Hello All,
>
>I am running netbackup 3.2
>and i am backing up a machine that runs tripwire.
>
>Whenever Netbackup does a full backup , tripwire reports every single file as
>being changed. This use to happen with incrementals but i added the following
>lines into the bp.conf file.
>
>USE_CTIME_FOR_INCREMENTALS
>DO_NOT_RESET_FILE_ACCESS_TIME
>
>and this seems to have solved the problem for incrementals.
>But, what can I do about the full backups.
>
>Howard Lapin
>
>
>
>_______________________________________________
>Veritas-bu maillist  -  Veritas-bu AT mailman.eng.auburn DOT edu
>http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu

---
W. Curtis Preston, Principal Consultant at Collective Technologies
Email: curtis AT colltech DOT com                (Best way to contact me)
Work : 408 452 5555                       (Leave a message.)
Pager: 800 946 4646, pin#1436065        (If urgent.)

Tap into the Collective Intellect (TM): http://www.colltech.com
Backup & Restore resources:        http://www.backupcentral.com