[ossec-list] Re: Integrity Checks and Diffs?

[Erick Kinnee <ekinnee@xxxxxxxxxxxx>]

This too is a pet peeve of mine. Cool, I'm glad you told me it  
changed. BUT WHAT CHANGED? I can't think off the top of my head a  
workable way to do this, other than the entire system, or at least  
the monitored directories or at least places like /etc in svn or some  
such.

On Sep 7, 2006, at 1:37 PM, Forrest Aldrich wrote:

> Maybe for text-only files, provide an option to include a  
> contextual diff output, which shows the changes of the monitored  
> file, with that of the known version --- this would require keeping  
> that old version archived somewhere, though.  Hmm...     may be  
> useful in some situations, knowing not only that the file was  
> changed, but WHAT was changed.
>
>
> _F