I recently activated tripwire on my redhat 9 box.
Tripwire reports that the time and date of the directory /root is being modified. Also the file inside root called .viminfo is also changing checksum and being modified.
I tried to google some answers but had no luck so far.
Is this normal behaviour for a linux system?
It seems when I log in to a user account such as Fred
/home/Fred directory updates the time and date on the folder.
I suspect there fore that this will also be true of root.
My question now is this not supposed to happen or should I modify the tripwire policy file not to monitor user folders date/time?