CheckConfig Arguably THE most important step in using tripwire on your system is the creation of a config file for the host. The config file for you machine must reflect vendor as well as local file structure conventions. For example on suns, /var and /usr are functionally equivelent, except with tripwire which cares that one is a symlink to the other. Some vendors (NeXT) put network tools such as nslookup in /usr/etc while other vendors (HP) put them in /usr/bin On some installations, the convention is to fill /usr/local with new code, on some locations /usr/local is full of symlinks which point to new code, some locations might decide to put new code in /Local. Since the config file MUST match the flavour of your system, CheckConfig was created to parse the tripwire.config file and report anomilies. usage:: CheckConfig [-v] file In non-verbose mode, CheckConfig reports merely on the existance of symbolic links in the file. This warns you that a symlink instead of a directory hierarchy or file is being monitored by tripwire. In verbose mode, CheckConfig also shouts about non-existant files and lists all other entries as either directories or files. Lance Bailey