0

I have a problem

It's been a while since I ran Tripwire. (One Year)

I'm able to make a report. (Takes about 1h30)

But when I run the command to accept the file, it just runs and runs and runs, never asks me for the local passphrase. (It ran for three days now)

 sudo /usr/local/sbin/tripwire --update --accept-all --twrfile /usr/local/lib/tripwire/report/Filenameremoved-20140811-164856.twr

I had to cancel it because it took our site online.

How can I find out why it's doing this, and how to fix it?

Update

I found the --verbose tag so now I can see it's output

It doesn't seem to be doing nothing now. Lets wait and see if it hangs.

Update #2

24Hrs later. Now that I have the verbose I can see what's going on. It's stopped outputting information. The last entries only say

 Database update: Removing record xyz

The CPU allocated to it is 2.7% instead of 90%. It doesn't visually seem to be doing anything. :(

Update #3

It's still running... One week later... X_x

Mallow
  • 144
  • 2
  • 9
  • May I have feedback on the downvote? – Mallow Aug 13 '14 at 17:21
  • Crap downvote, I think. You just answered your own question, but you can't actually mark it as an answer because of the site's time limit on when you can do that. – Mikey T.K. Aug 13 '14 at 18:34
  • @MikeyT.K. The tripwire isn't accepting the report yet a full 24 hours later even though it's verbose – Mallow Aug 14 '14 at 15:27
  • 1
    Depending on your needs, perhaps AIDE would work out better for you (it works faster than tripwire for some). – Dani_l Aug 14 '14 at 16:16

0 Answers0