CentOS 5.1, i686.
I have a directory, say "foo", containing several hundred directories down to about six levels deep, and about 33,000 files. Periodically I make a tar archive of the whole lot:
tar cf foo.tar foo
and I often get from a few dozen to several hundreds of:
tar: XXXXX: file changed as we read it
followed by an exit status of zero.
I am absolutely sure (100%, positive) that no files were changed during the period that tar was running: some of the files that are often flagged as changed have not been modified in many months, and have only been read by tar and the backup system. If I immediately repeat the tar command, it may succeed without any of these messages or flag a different set of files as changed, when again they have not. I'm sure from Googling that many have seen this. The system does also run Samba and the file system on which these files are resident is accessible from Windows clients, but none of these particular files are ever used from the Window side. The file system is also NFS exported, but again the files are not in use on any NFS client.
What is interesting (that is, suspicious) is that on upgrading (clean install) the system from a previous incarnation of CentOS 4.6 (which also exhibited the problem) to CentOS 5.1, keeping the same tar version (1.15.1) and making no hardware changes, the incidence of these messages has _hugely_ increased. I have also seen a couple of repeated instances of "stat <file>" return changed times that differ from one another, and in all cases the file has not changed at all: the difference in the reported change times is always exactly 5 hours (which is my offset from UTC). I can't reproduce that at will.
If anyone has a clue stick to beat me with, please do; it's getting a little old.
Steve