I wasn't around -- but what I gather they were haphazardly doing file integrity monitoring of huge swaths of the filesystem using OSSEC.