Running an Integrity Check

When running an integrity check, Tripwire compares the current, actual filesystem objects with their properties as recorded in its database. Violations are printed to standard output and saved in a report file that can be accessed later by twprint. For more information on viewing Tripwire reports, see the Section called Printing Reports.

An email configuration option in the policy file even allows particular email addresses to be sent notices when certain integrity violations occur. See the Section called Tripwire and Email for instructions on how to set this up.

To run an integrity check, use the following command:

/usr/sbin/tripwire --check

This command requires some time to run in most situations, depending upon the number of files to be checked.