meta-Diffing a running machine

[Peter Arremann]

On Wednesday 19 October 2005 21:02, Philip Prindeville wrote:
> I was wondering if there's a handy way to look for files
> on a machine (like /etc/hosts, /etc/passwd, /etc/sysconfig/*, etc)
> that have been modified relative to the installed RPM's.
>
> Since files installed via RPM have MD5 checksums, it shouldn't
> be too hard to find tweaked files, right?
>
> I recently realized that I have no easy way to isolate and summarize
> the machine I currently use versus its initial state "out of the box".
>
> What tools are available?
>
> Thanks,
>
> -Philip

rpm will do the trick...
rpm -V will show you the modifications to the rpm you specified and xargs can 
help you there very nicely. rpm -qa | xargs rpm -V 
or rpm -V `rpm -qa` if you like that one better.

If the output line has a 5 in it, then your md5 sum doesn't match. 
That leaves you with
rpm -V `rpm -qa` | grep ^..5

Peter.