Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an installation that has been tampered with, and I want to find out what exactly has been changed.

I can run


which gives me a list of modified files. Now I am looking for a convenient way to see the diffs (assuming that all files have textual content) against the original rpms (which I have available).

What would be the easiest way of doing this, given that I am dealing with ~20 packages and ~200 changed files. Is there something like "rpm diff"???

share|improve this question

1 Answer 1

The best way is to write a script that generates MD5sums for all packages/files and compares them to the MD5sums of your reference RPM's.

share|improve this answer
This is what rpm -V already does for me. I am looking for a way to conveniently compare the content, not the MD5 sums. And I hoped that I can get around writing my own scripts... –  Alex Krauss Apr 11 '12 at 12:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.