
Chapter 12. Installing and Configuring Tripwire 153
12.9. Printing Reports
The twprint -m r command will display the contents of a Tripwire report in clear text. You must
tell twprint which report file to display.
A twprint command for printing Tripwire reports looks similar to the following (all on one line):
/usr/sbin/twprint -m r --twrfile
/var/lib/tripwire/report/
name .twr
The -m r option in the command tells twprint to decode a Tripwire report. The --twrfile option
tells twprint to use a specific Tripwire report file.
The name of the Tripwire report that you want to see includes the name of the host that Tripwire
checked to generate the report, plus the creation date and time. You can review previously saved
reports at any time. Simply type ls /var/lib/tripwire/report to see a list of Tripwire reports.
Tripwire reports can be rather lengthy, depending upon the number of violations found or errors
generated. A sample report starts off like this:
Tripwire(R) 2.3.0 Integrity Check Report
Report generated by: root
Report created on: Fri Jan 12 04:04:42 2001
Database last updated on: Tue Jan 9 16:19:34 2001
=======================================================================
Report Summary:
=======================================================================
Host name: some.host.com
Host IP address: 10.0.0.1
Host ID: None
Policy file used: /etc/tripwire/tw.pol
Configuration file used: /etc/tripwire/tw.cfg
Database file used: /var/lib/tripwire/some.host.com.twd
Command line used: /usr/sbin/tripwire --check
=======================================================================
Rule Summary:
=======================================================================
-----------------------------------------------------------------------
Section: Unix File System
-----------------------------------------------------------------------
Rule Name Severity Level Added Removed Modified
--------- -------------- ----- ------- --------
Invariant Directories 69 0 0 0
Temporary directories 33 0 0 0
* Tripwire Data Files 100 1 0 0
Critical devices 100 0 0 0
User binaries 69 0 0 0
Tripwire Binaries 100 0 0 0
Commenti su questo manuale