How do I view a tripwire report file?

[capitano]

Tripwire puts a report in /var/lib/tripwire/report
on my system, and usually called something like
myhostname-20011215-morenumbers.twr

I don't see how to view the contents of this report
(it's gibberish in normal text editors).
Does anybody know how to view the report?

Thank you

 

[ifincham]

Hi,

You would use twprint. For example :

/usr/sbin/twprint -m r --twrfile /var/lib/tripwire/report/<name>.twr

See -->

http://www.redhat.com/docs/manuals/linux/RHL-7.2-Manual/ref-guide/s1-tripwire-printing-reports.html

Regards

 

[krischrist]

Hi,
You can direct tripwire to send you an email report.
For this type
/usr/sbin/tripwire --check --email-report.

But make sure that on the twpol.txt
you have email to defined wherever you find severity
eg:}
severity = $(SIG_HI), emailto = EMAILADDRESS
You have to do it manually do it all over the place.If tripwire does not detect email address of the local host automatically.

regards
Krischrist

http://krischrist.tripod.com

http://krischrist.xaper.com