In my fcheck.cfg file I just wanted to check on the /etc/ directory so I am going to modify a file (rpc)
and add a hidden .file and then run the fcheck on compare mode:
The last step produced a database /usr/local/fcheck/sol.dbf holding infos or snapshots on the /etc/ directory:
So lets fcheck in compare mode :
1) - we are going to run fcheck with verbose (nothing in logs):
[root@linux2 /etc]# /usr/local/fcheck/fcheck -adsx
PROGRESS: validating integrity of Files
STATUS:
WARNING: ["linux2"] /usr/local/fcheck/sol.dbf
[Sizes: 208 - 100868, CRCs: 7ea561f477bdeb77d790497a9e50c884 - ce01b95c7ec6a9ff98f944561bff1cad]
PROGRESS: validating integrity of /etc/
STATUS:
WARNING: ["linux2"] /etc/rpc
[Sizes: 1595 - 1594, Times: Jun 17 18:27 2001 - Jul 18 23:45 2001, CRCs: d83e04a070f0f235085ad13f78c3105e - fb5fda10903045ca3a535c75acefa4e5]
ADDITION: ["linux2"] /etc/.file
Inode Permissons NLink Uid Gid Size Created On
32407 -rw-rw-r-- 1 0 0 0 Jul 18 23:43 2001
we can see that we have a new creation of a file .file and we have 2 modified files ........[root@linux2 /etc]# /usr/local/fcheck/fcheck -adsxl