Tripwire reports daily changes of webmin files, is that correct?

Webmin
1

Hi,

I’m working on securing my servers and installed tripwire recently in order to watch for changing files.

In the nightly scan I get a lot of changed files like these:
“/etc/webmin/apache”
“/etc/webmin/apache/site”
“/etc/webmin/security-updates”
“/etc/webmin/security-updates/current-all.cache”
“/etc/webmin/security-updates/current.cache”
“/etc/webmin/security-updates/updates.cache”
“/etc/webmin/status”
“/etc/webmin/status/fails”
“/etc/webmin/status/history”

My guess is this is just fine, but I want to double check if this is correct so I can exclude this etc/webmin/ folder.

Thanks!

2

The following will surely change almost daily since they are cache files and status logs. No idea with the rest.

“/etc/webmin/security-updates/current-all.cache”
“/etc/webmin/security-updates/current.cache”
“/etc/webmin/security-updates/updates.cache”
“/etc/webmin/status”
“/etc/webmin/status/fails” "
/etc/webmin/status/history"