----- Original Message ----- From: "Eric Robinson" <[EMAIL PROTECTED]> Subject: RE: [RLUG] Best Way to Detect All Changes After Software Installor Removal?
I thought of tripwire, but it seems like setting it up is a fair amount of work for something that should be a simple command-line. You'd have to set up tripwire on any machine that you wanted to do this on. Plus, I'm not sure, but is not tripwire limited to reporting on a list of pre-configured file watches, and basic md5 hash differences? What I want is a nice, clean, plaintext report that shows what files were added, which were removed, which changed, etc., everywhere in the system, since the last time I ran a snapshot. ---------- How about: cd / ls -alR | diff - lastSnapshot.txt ls -alR > lastSnapshot.txt -- Easy peasy: Just go to your root directory and take a snapshot of all the files on your system using ls and save it to a file. Then whenever you want to compare just run ls again having diff compare the output with your last snapshot. Afterwards save the snapshot. You could even setup cron to take daily snapshots and name them accordingly. I love diff. Diff is your friend. It is the perfect example of a Unix tool - a stupid little command line program that only does one thing. But it does it so well! It really wouldn't be that difficult to get your snapshots to contain all of the data in every .conf file it finds or for all the files in a given (critical) directory. Diff doesn't care what it is looking at - it will just tell you if it changes. Mike _______________________________________________ RLUG mailing list [EMAIL PROTECTED] http://www.rlug.org/mailman/listinfo/rlug
