On Wednesday 19 October 2005 21:02, Philip Prindeville wrote: > I was wondering if there's a handy way to look for files > on a machine (like /etc/hosts, /etc/passwd, /etc/sysconfig/*, etc) > that have been modified relative to the installed RPM's. > > Since files installed via RPM have MD5 checksums, it shouldn't > be too hard to find tweaked files, right? > > I recently realized that I have no easy way to isolate and summarize > the machine I currently use versus its initial state "out of the box". > > What tools are available? > > Thanks, > > -Philip rpm will do the trick... rpm -V will show you the modifications to the rpm you specified and xargs can help you there very nicely. rpm -qa | xargs rpm -V or rpm -V `rpm -qa` if you like that one better. If the output line has a 5 in it, then your md5 sum doesn't match. That leaves you with rpm -V `rpm -qa` | grep ^..5 Peter.
