[Integrit-users] Re: Can't check for deleted files?

[Ed L C. <ec...@te...>]

(Cc'ed to integrit-users mailing list.  See
http://sourceforge.net/mail/?group_id=15369 for info and how to subscribe.) 

David Alban <da...@re...> writes:

> Ed,
> 
> I'm evaluating the possible large scale use of integrit for a client.
> 
> When I run integrit in check mode, I get a message that says
> something similar to[1]:
> 
>   not running in update mode: will not detect deleted files

From main.c:

    if (opts.do_check) {
      if (opts.do_update)
	check_for_missing(&opts);	/* only do this after new current cdb
					   is closed (i.e. cdb_make is done) */
      else if (opts.verbose > 0)
	fputs(PROGNAME ": not doing update, so no check for missing files\n",
	      stderr);
      
      close_known_cdb(&opts);
    }

> But then in update mode, it doesn't detect the deleted files.
> 
> How does one detect deleted files with integrit?

See the logic above: if you've opted to do a check *and* an update,
you'll see missing files.  That's the only time you'll see them
because that's the only time that integrit is checking the current
filesystem (update) and also simultaneously has access to the old
state (check).  You need to have both to know whether a file is
missing or not.

I should mention that in the documentation if it isn't there already. 

-- 
--Ed Cashin                   PGP public key:
  ec...@te...       http://www.terry.uga.edu/~ecashin/pgp/