help with tripwire ...

[K.C. Chan]

all,
I am getting error when trying to update the policy file:
# tripwire -m p twpol.txt
Parsing policy file: /etc/tripwire/twpol.txt
Please enter your local passphrase:
Please enter your site passphrase:
======== Policy Update: Processing section Unix File System.
======== Step 1: Gathering information for the new policy.


### Error: Policy Update Changed Object.
### An object has been changed since the database was last updated.
### Object name: Conflicting properties for object /root
### > Modify Time
### > Change Time
======== Step 2: Updating the database with new objects.
======== Step 3: Pruning unneeded objects from the database.
Policy update failed; policy and database files were not altered.

Any idea?

[Stuart Browne]

You'll need to make sure you accept all current system alterations prior to updating the policy (as against re-creating a policy).

Basically, just update the current database (after reviwing the current tripwire report in /var/lib/tripwire/report/...), 'tripwire -m u --accept-all' if memory serves, then try updating the policy.

[Steven E. Protter]

Wow, not even an error code.

echo $?

What response code did the program give?

Follow that evidence.

Check that appropriate permissions are set on the file being updated.

SEP

[Gopi Sekar]

Looks to be a particular file got modified (in terms of permissions, size, timestamp etc) which is being watched by tripwire.

either you accept all the changes and re run the update or check which file has modified and whats the reason.

Gopi