[rancid] Duplicate entries, sort of

[heasley]

Sun, Oct 11, 2015 at 04:55:52PM +0000, on at LEFerguson.com:
> I am curious if someone knows of a good approach (which might apply to the OP as well) to monitor flash for unexpected changes, some way to audit or trap so you know when it happened?  Especially in my case, where the date is not changing, there's no indication except when rancid pulls a new copy. 

perhaps a tcl script on the device; atm i forget what cisco calls that.

i suspect that in your case it is a low-level process that it bypassing the
normal filesystem code, but their api could just as easily offer a manner
for users to set the date.  i suppose that rancid could just drop the file
number.

> But for Ryan's case, if you have logs, I'd look at the date/time indicated and see if something else was going on?   I think changing rancid in this case will just hide the cause, not fix it.  As I think it would in mine.  But I'm sympathetic as I have effectively an alarm without a clue what to do.
> 
> PS. I'm aware of the very old crypto crash bug, and the guy managing these is or has opened a cisco case to see if it applies, no word yet.  But why wouldn't they give new dates? 
> 
> retrieving revision 1.17
> diff -u -4 -r1.17 trsrasa5505.moran.local @@ -29,10 +29,10 @@
>   !Flash:   117  4181246     Apr 28 2008 12:41:20  securedesktop-asa-3.2.1.103-k9.pkg
>   !Flash:   118  398305      Apr 28 2008 12:41:36  sslclient-win-1.1.0.154.pkg
>   !Flash:   119  11491880    Jun 26 2011 15:45:18  asdm-623.bin
>   !Flash:    12  4096        Mar 06 2012 06:44:46  crypto_archive
> - !Flash:   140  394148      Dec 06 2011 22:11:24  crypto_archive/crypto_eng0_arch_1.bin
> - !Flash:   141  394148      Mar 06 2012 06:44:46  crypto_archive/crypto_eng0_arch_2.bin
> + !Flash:   142  394148      Dec 06 2011 22:11:24  crypto_archive/crypto_eng0_arch_1.bin
> + !Flash:   143  394148      Mar 06 2012 06:44:46  crypto_archive/crypto_eng0_arch_2.bin
>   !Flash:   121  15390720    Sep 14 2011 06:44:12  asa825-k8.bin
>   !Flash:   122  28672       Dec 31 1979 18:00:00  FSCK0000.REC
>   !Flash:     3  4096        May 30 2008 10:41:34  log
>   !Flash:    13  4096        Jun 26 2011 16:01:38  coredumpinfo