Question: A Zabbix server I am currently started showing an alert like this:

```
/etc/passwd has been changed on Router

```

Now, on this Router machine I don't have a history of the passwd file so I cannot see exactly what changed, but what I know is that the time of the alert roughly coincided with this `Router` machine being rebooted. As soon as the router came back up, Zabbix started throwing this alert.

Running `ls -l /etc/passwd` on the `Router` device shows that the last modified timestamp is roughly the same as the time of the reboot.

This could be pure coincidence, but I'd rather double check here since I could not find anything online: can a simple device reboot cause the `/etc/passwd` file to be updated (if not in the contents, at least in the timestamp)?

Answer: 
Another way using `ls` and `grep -v`. The `-v` option inverts the matching so only non matching lines are listed.

```
mv `ls | grep -v folder2` folder2

```

Note that backticks are used and not single quotes in the command.
**`find`** + **`mv`** solution:

```
find folderN/ -mindepth 1 ! -wholename '*/folder2' -exec mv "{}" "folderN/folder2" \;

```