OSSEC integrity checksum alert - what caused the change?
Two reasons are:
- You've actually been hacked
- Prelinking is enabled
You can disable prelinking by editing /etc/sysconfig/prelink from:
PRELINKING=yes
to:
PRELINKING=no
And running:
prelink -ua
Source: http://www.ossec.net/wiki/Know_How:Check_Sums