Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is there application for linux which would run everyday, and if that app suspect changed files, warn me via email with list of changed files?

share|improve this question
up vote 3 down vote accepted

If you've got command line access to the file location, you can use md5sum to just check for changed files. Anytime you make changes to the files you can rebuild the md5sum that you're calculating against.

First, build a list of md5 checksums to compare against

find $path_to_file_storage -type f -exec md5sum {} \; > checksum_file.md5

Once you have the checksum file, then you can quickly find only changed files:

md5sum --quiet -c checksum_file.md5

That will show you any file that has been changed. If you use the absolute path to the beginning of the file storage for the find command, it will store the absolute path for all of the files that have the checksum generated. Anytime you intentionally modify a file in the directory, you can re-run the find command to rebuild the md5 checksums.

If you've got only a specific directory or set of directories you'll have to tweak the find command so that it will only find the files you want cross-reference.

Once you have the md5 checksum file, you can put the md5sum command line into a cron job. By default, cron jobs that don't have output redirected send anyoutput that normally generated on stdout and stderr via an email to the user who's crontab the job was setup in.

share|improve this answer
WOW thanks! /var/www/tatar/activate.php: WRONG md5sum: WARNING: 1 from 950 md5sums did not MATCH! root@fb:/var/www# And what about to check content changed? – genesis Jun 30 '11 at 17:30
@genesis For checking what content is changed, the diff tool (assuming you have a backup of the file in the unchanged state) can be used to show the differences. Unfortunately, I don't know the proper command like switches for that tool (basic usage is diff FILE1 FILE2) – Matrix Mole Jun 30 '11 at 20:44

There are a number of tools to do this. I use aide, but there is also tripwire, and probably several others which do the same job. Also, if you are using plesk virtual hosting, it has a tool called rkhunter, which checks files as well as a number of other tasks.

What is your actual goal?

share|improve this answer
goal is to prevent hackers from getting some phishing-stealing lines into my code. – genesis Jun 30 '11 at 15:59
That's actually more of a challenge. Checking the system config and system executables have not changed is easy - They change, shout, but web application changes tend to be frequent, and you probably don't want to have to run a 5 minute system scan every-time a typo is corrected in an HTML file. How do you manage the distribution of changes to the server(s)? – Haqa Jul 2 '11 at 10:04

Theres a nice comparison, including the venerable Tripwire (alt), at Samhain Labs

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.