Jim Perrin wrote: > On Wed, Apr 9, 2008 at 11:39 AM, Steve Campbell <campbell at cnpapers.com> wrote: > >> I'm trying out aide since tripwire doesn't seem to be in the 5. releases >> anymore. I do not have Selinux on the server (no at installation), and I >> just yum installed the aide rpms, so I should have the latest. >> >> When I run my aide --init, I get all of these lines for all the files: >> > > There's an aide how-to for centos5 here -> > http://www.bofh-hunter.com/2007/12/04/centos-5-and-aide/ > > Thanks Jim, Believe it or not, that's what I started out with. After running the entire --init/--check scenario again, I see in the log files and the output, that all files get this message, and a normal output of what should be there showing changed and unchanged files appear at the bottom of the log. So what is this "lgetfilecon_raw failed for" showing up for each file saying to me? Is it a verbosity setting, or something like that? Thanks steve