[cobalt-security] tripwire alert - unexplained . . .

["Fragga" <fragga@xxxxxxxxxxxx>]

greets all,
i got this in me tripwire report . . . .
----------------------------------------------------------------------------
---
Rule Name: Libraries (/usr/lib)
Severity Level: 66
----------------------------------------------------------------------------
---
Modified:
"/usr/lib/perl5/man/whatis"
----------------------------------------------------------------------------
---
do the raq 4`s have a cron which updates the whatis library ?
i asked the people the box is leased from and they couldnt
understand what had occured. these were 2nd line support guys
however they did say this wasnt the usual location of the whatis
library ? note no programs / services of any sort were added to
update the whatis library that i know of.

any suggestions / ideas would be welcome.
thanks in advance.

fragga

ps. is there a command to see every cron which is going to be run
regardless or owner, etc ?