When running an integrity check, Tripwire
compares the current, actual filesystem objects with their properties as
recorded in its database. Violations are printed to standard output and
saved in a report file that can be accessed later by
twprint. For more information on
viewing Tripwire reports, see the section called Printing Reports.
An email configuration option in the policy file even allows particular
email addresses to be sent notices when certain integrity violations
occur. See the section called Tripwire and Email for instructions on how to
set this up.
To run an integrity check, use the following command:
/usr/sbin/tripwire --check |
This command requires some time to run in most situations, depending
upon the number of files to be checked.
