IDS goes off at /etc

Hi, Does anybody know what makes my IDS (tripwire) go off at /etc each other day? No changes otherwise. Just the directory /etc being modified. I suppose something creates and removes again a file in /etc regularly, but can't figure out what it is. changed: drwxr-xr-x root 4096 Jul 16 22:05:13 2002 /etc ... ### Attr Observed (what it is) Expected (what it should be) ### =========== ============================= ============================= /etc st_mtime: Tue Jul 16 22:05:13 2002 Sat Jul 13 11:16:03 2002 st_ctime: Tue Jul 16 22:05:13 2002 Sat Jul 13 11:16:03 2002 Best regards from Bremen, Mit freundlichen Grüßen aus Bremen, Matthias Riese