I just had one strange case of modified /usr/bin/mysql_client_test file.
We have received a LFD notification about file modification.
I checked the file and modify/change stamp was not changed and file size was not changed. I then compared md5 hash with other servers with the same "MySQL-test" version and md5 hash was really different on that server. I can't find anything other strange on that server beside that. I tried to look into a binary file at the begining and at the end of file and it was identical like the same binary on other servers.
Now even more strange thing is that few hours later new LFD notification about the same file is received. I again checked and comapared md5 hash with other servers and now md5 again match with all other servers, so file is somehow restored to original again...
Does anyone have some explanation for this? Is it maybe possible that some filesistem corruption was the cause of file difference and then maybe some sector relocation fixed it later. I also have to mention that this is a hardware RAID-1 array.