When i scan my system with tripwire and try to update after with

tripwire --update -Z low

i get the error:

### Error: File could not be opened.
### Filename: /var/lib/tripwire/report/nesystem-20101217-212722.twr
### No such file or directory
### Exiting...

What's the reason?


tripwire --update requires a particular (usually the most recent) tripwire output file to operate on. When you last ran tripwire --check it will have created a report file; if you want to update from that, find the name of that report file (usually the most recent creation in /var/lib/tripwire/report) and do

tripwire --update -Z low -r /var/lib/tripwire/report/THATFILE

If you're using the most recent tripwire output file, -Z low is often not required, and I think it's generally a good idea to omit it: if there have been any further changes since the report was generated, you want to know about them, and resolve them manually.

If you must have a fast workaround, you could put something like this in your .bashrc file (assuming you're using bash):

alias triplast="tripwire --update -r `ls -1rt /var/lib/tripwire/report|tail -1`"

which will run tripwire in update mode on the most recent entry in the reports directory.

  • hi madhatter, why doesn't choose the most recent by it's own? at the beginning shortly after i installed it, it worked several times with just tripwire --update -Z low command? Is there any other way to tell tripwire just take the last report? – NES Dec 17 '10 at 20:46
  • I can't comment on your experiences, but they haven't matched mine. By default, when it needs a report, it generates one from the current time. It is genuinely undesirable, to my mind, that it automatically pick the most recent report, as (on systems adminned by more than one person, which are the ones where you most need tripwire) this could lead to one's accidentally signing off a bunch of changes one hasn't made. This is also a hazard of the use of "-Z low". But if you desire fixes, I have amended my answer with a workaround. – MadHatter supports Monica Dec 18 '10 at 7:48
  • Sorry, my fault. I meant. Why is tripwire not able to auto name the latest report file so that i don't have to write the name of the file with -r as execution parameter. – NES Dec 18 '10 at 9:49
  • I wouldn't say "is not able" so much as "won't"; hopefully I've clarified why that would be unsafe behaviour as a default. That said, it's free software; you're welcome to edit yours so that it does what you want! – MadHatter supports Monica Dec 18 '10 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.