Tripwire and alternatives

The best alternative is AIDE. You should be able to install the 64bit version using your package manager as its in most distros - CentOS has v0.13.1 in the base repository.

As it says:

AIDE (Advanced Intrusion Detection Environment) is a free replacement for Tripwire. It does the same things as the semi-free Tripwire and more.

There are other free replacements available so why build a new one? All the other replacements do not achieve the level of Tripwire. And I wanted a program that would exceed the limitations of Tripwire.

Update from 2019:

The original link above for AIDE appears to be dead. The project lives on in Github at https://aide.github.io/. Interestingly, both AIDE and a currently-maintained version of Tripwire are available on Github now:

  • https://github.com/aide/aide
  • https://github.com/Tripwire/tripwire-open-source

You might have a look at fcheck. It's rather old, but i like its status report: Here's a sample report:

PROGRESS: validating integrity of /usr/lib/
STATUS:passed...

PROGRESS: validating integrity of /root/
STATUS:
    WARNING: [hostname] /root/.bash_history
    [Sizes: 13769 - 14445, Times: Jul 01 11:56 2010 - Jul 01 14:48 2010, CRCs: c298c20f5c2a594c3dc9a1bfa517192c - 197d2284d1182505bc357a505af72472]

You said that you want to "track changes in the key files/folders in the filesystem".

Why? What's the end goal? Are you doing this for security or some other reason? What type of granularity do you need?

Many backup systems like Bacula will take checksums of files and compare them on whatever schedule the system runs...