tripwire --update
requires a particular (usually the most recent) tripwire output file to operate on. When you last ran tripwire --check
it will have created a report file; if you want to update from that, find the name of that report file (usually the most recent creation in /var/lib/tripwire/report
) and do
tripwire --update -Z low -r /var/lib/tripwire/report/THATFILE
If you're using the most recent tripwire output file, -Z low
is often not required, and I think it's generally a good idea to omit it: if there have been any further changes since the report was generated, you want to know about them, and resolve them manually.
If you must have a fast workaround, you could put something like this in your .bashrc file (assuming you're using bash):
alias triplast="tripwire --update -r `ls -1rt /var/lib/tripwire/report|tail -1`"
which will run tripwire in update mode on the most recent entry in the reports directory.