File Locations

Before working with Tripwire, you should know where important files for the application are located. Tripwire stores its files in a variety of places depending on their role:

• The /usr/sbin directory stores the tripwire, twadmin, and twprint programs.

• The /etc/tripwire directory contains the local and site keys (*.key files) and the initialization script (twinstall.sh), as well as the sample and actual configuration and policy files.

• The /var/lib/tripwire directory contains the Tripwire database of your system's files (*.twd) and a report directory where Tripwire reports are stored. The Tripwire reports, named host_name-date_of_report-time_of_report.twr, detail the differences between the Tripwire database and your actual system files.