Thu 25 Jun 2009
Find out what’s changed on a system
Posted by Rick under Command Line, DataCenter, Linux/Kernel, OSS News, Tools/Utils, Training and How To's
[2] Comments
For those who have been handed the keys to a system and simply been told, “It’s not working”, it can be very useful to know what files have been modified from the stock installation of the system.
If you are working with an RPM-based installation, such as Suse Linux Enterprise Server, the following command (by way of Linux Journal) can be very useful:
rpm -qa | xargs rpm --verify --nomtime | less
This command will spit out output that looks roughly like this:
missing /usr/local/src .M...... /bin/ping6 .M...... /usr/bin/chage .M...... /usr/bin/gpasswd ....L... c /etc/pam.d/system-auth .M...... /usr/bin/chfn .M...... /usr/bin/chsh S.5..... c /etc/rc.d/rc.local S.5..... c /etc/sysctl.conf S.5..... c /etc/ssh/sshd_config S.5..... c /etc/updatedb.conf
A quick look through the man pages will tell you what the flags mean:
c %config configuration file.
d %doc documentation file.
g %ghost file (i.e. the file contents are not
included in the package payload).
l %license license file.
r %readme readme file.
S file Size differs
M Mode differs (includes permissions and file type)
5 MD5 sum differs
D Device major/minor number mismatch
L readLink(2) path mismatch
U User ownership differs
G Group ownership differs
T mTime differs
So, in our sample output you can quickly determine that the configuration file for the OpenSSH daemon (/etc/ssh/sshd_config) has been modified, along with several others.
This can give you a quick insight into the state of the system, and may allow you to trace down the source for any errors more efficiently
Last 3 posts by Rick
- Find out what's changed on a system - June 25th, 2009
- Gnome-Agenda for quick calendar access - March 20th, 2009
- Customer or Criminal? (Hint: Don't treat one like the other) - March 9th, 2009
2 Responses to “ Find out what’s changed on a system ”
Comments:
Leave a Reply
You must be logged in to post a comment.




June 25th, 2009 at 7:38 pm
There is a faster (and more reliable) version of the command, which is
rpm --verify --all --nomtime | lessThis avoids shell globbing and splitting issues and checks all the packages at once, which is faster than the multiple invocations with xargs.
July 4th, 2009 at 2:00 pm
If you MD5sum to detect an intruder/cracker you would have to additionally rpm –checksig all packages after refreshing all gpg-pubkeys (tools like checkroot http://wwwu.edu.uni-klu.ac.at/estellnb/checkroot/ can do this).