Good evening folks,

Today I ran rpm -Va --noghost on one of my hosts which I just updated to RHEL 7.6. I was surprised to find the following output:

[root@rhel-t2 ~]# rpm -Va --noghost
[...]
S.5....T.  c /etc/os-release
[root@rhel-t2 ~]#

I read this file some times for information but i certainly never altered it on purpose. Why does it differ in size? What are possible reasons that this file is not compliant with the metadata it is checked against?

Is there any possibility to find out what changed this file?

This is not an issue. I ask out of academic interest because I think there is a chance I might learn something.

Best regards,
Joerg