What are some reasons why an event would constantly show up as

added

, even though it wasn't modified? For instance, I have a scheduled query to be ran for modifications to the

/etc/hosts

file on my machine. Every few days it'll make an entry in the results.log for a modification and have the action as

added

, even though it wasn't new from the last time. Any ideas?