Who changes `/proc/sys/kernel/random/boot_id` in Linux (SLES)?

3 votes
2 answers
1702 views
                          Well, I thought it's just logical that the kernel changes /proc/sys/kernel/random/boot_id during boot, and then keeps that value while running.
At least that would make sense to me if the intended use of boot_id is to find out *when* the machine rebooted.

When monitoring the file using monit, I noticed that the file seems to change even if the machine did not reboot; that means the timestamp of the file changes, not the contents.

So I wonder who changes the file's timestamps.

For reference, here's my monit configuration being used:
~~~lang-monitrc
  check file bootid with path /proc/sys/kernel/random/boot_id
    #if changed timestamp then alert
    if content !=
       "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}"
    then alert
    if changed checksum then alert
    group local
~~~

When checking the monitoring results I got:
~~~lang-text
File 'bootid'
  status                       OK
  monitoring status            Monitored
  monitoring mode              active
  on reboot                    start
  permission                   444
  uid                          0
  gid                          0
  size                         0 B
  access timestamp             Tue, 07 May 2024 11:01:31
  change timestamp             Tue, 07 May 2024 11:01:31
  modify timestamp             Tue, 07 May 2024 11:01:31
  content match                no
  checksum                     d174a6b860689b62417af5eccd2b17ee (MD5)
  data collected               Tue, 07 May 2024 11:46:11
~~~
Cross-checking I got:
~~~lang-text
# stat /proc/sys/kernel/random/boot_id
  File: '/proc/sys/kernel/random/boot_id'
  Size: 0               Blocks: 0          IO Block: 1024   regular empty file
Device: 4h/4d   Inode: 9770501     Links: 1
Access: (0444/-r--r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2024-05-07 11:01:31.721335498 +0200
Modify: 2024-05-07 11:01:31.721335498 +0200
Change: 2024-05-07 11:01:31.721335498 +0200
 Birth: -
# uptime
 11:49am  up 14 days  0:49,  4 users,  load average: 0.00, 0.00, 0.00
~~~
The system is running SLES12 SP5 on x86_64, and the only "suspects" are cron-jobs and "snapper":
~~~lang-journal
May 07 11:00:01 v04 systemd: Started Session 7426 of user root.
May 07 11:00:01 v04 systemd: Started Session 7428 of user root.
May 07 11:00:01 v04 systemd: Started Session 7427 of user root.
May 07 11:00:01 v04 CRON: (root) CMD ([ -x /usr/lib64/sa/sa1 ] && exe
May 07 11:00:01 v04 run-crons: suse.de-snapper: OK

~~~
                        
Asked by U. Windl (1715 rep)
May 7, 2024, 10:00 AM
Last activity: May 17, 2024, 10:08 AM
Who changes `/proc/sys/kernel/random/boot_id` in Linux (SLES)?

Related Questions
