These look like someone has saved a new copy of a text file, either with some automation or manually, notice the dates which are (reasonably) current.
There's an example out there in the mailing list for WAP's (http://www.gossamer-threads.com/lists/rancid/users/7715) that should provide some guidance how you could omit these entirely by patching, which worked for the WAP issues.
I believe, however, that you should not patch it but find the underlying cause. I'll share my own similar case (and not to hijack the thread but maybe someone has a clue for me). I have two ASA's that are giving differences like the below. Notice that all that changes is the number on the left (is that some kind of file number) without producing a new date. I THINK what is happening is that the router reboots, runs FSCK and gives a new file number for reasons a bit unclear (it is not producing new FSCKxxxx.REC files, they are all old and unchanging). However, I am unconvinced there is a reboot each time, as (a) they never show up as down on monitoring (polling 60 seconds so it might miss) and while one shows a few reboots, the other only had 1 in a month and more differences than that.
I am curious if someone knows of a good approach (which might apply to the OP as well) to monitor flash for unexpected changes, some way to audit or trap so you know when it happened? Especially in my case, where the date is not changing, there's no indication except when rancid pulls a new copy.
But for Ryan's case, if you have logs, I'd look at the date/time indicated and see if something else was going on? I think changing rancid in this case will just hide the cause, not fix it. As I think it would in mine. But I'm sympathetic as I have effectively an alarm without a clue what to do.
PS. I'm aware of the very old crypto crash bug, and the guy managing these is or has opened a cisco case to see if it applies, no word yet. But why wouldn't they give new dates?
retrieving revision 1.17
diff -u -4 -r1.17 trsrasa5505.moran.local @@ -29,10 +29,10 @@
!Flash: 117 4181246 Apr 28 2008 12:41:20 securedesktop-asa-3.2.1.103-k9.pkg
!Flash: 118 398305 Apr 28 2008 12:41:36 sslclient-win-1.1.0.154.pkg
!Flash: 119 11491880 Jun 26 2011 15:45:18 asdm-623.bin
!Flash: 12 4096 Mar 06 2012 06:44:46 crypto_archive
- !Flash: 140 394148 Dec 06 2011 22:11:24 crypto_archive/crypto_eng0_arch_1.bin
- !Flash: 141 394148 Mar 06 2012 06:44:46 crypto_archive/crypto_eng0_arch_2.bin
+ !Flash: 142 394148 Dec 06 2011 22:11:24 crypto_archive/crypto_eng0_arch_1.bin
+ !Flash: 143 394148 Mar 06 2012 06:44:46 crypto_archive/crypto_eng0_arch_2.bin
!Flash: 121 15390720 Sep 14 2011 06:44:12 asa825-k8.bin
!Flash: 122 28672 Dec 31 1979 18:00:00 FSCK0000.REC
!Flash: 3 4096 May 30 2008 10:41:34 log
!Flash: 13 4096 Jun 26 2011 16:01:38 coredumpinfo
-----Original Message-----
From: Rancid-discuss [mailto:rancid-discuss-***@shrubbery.net] On Behalf Of heasley
Sent: Sunday, October 11, 2015 12:15 PM
To: Ryan Milton <***@gmail.com>
Cc: Rancid-***@shrubbery.net
Subject: Re: [rancid] Duplicate entries, sort of
Post by Ryan MiltonForgive that I've asked this before. I have a mix of hardware, all us
good except one cisco that rancid sends 100's of emails for daily.
What happens is that rancid reads the flash changes and reports on it
constantly.
How do I edit rancid to ignore these?
Pardon the small screenshot.
make sure that you are running rancid 3.2. if its still occuring, its either a flaw in the IOS or the filter in rancid is missing it. upgrade the ios if its an ios flaw, else show the changes to us for modification of the filter.