[Olli Artemjev <olli@me...>]

On Tue, 10 Apr 2001, Gary E. Miller wrote:
> 1. too much white space.
agree.
 
> 2. NOTHING usefull is at the top.  I know what the hostname is. It
> was in the from address of the email.  Same for the IP, and the date.
> Remove all this.  I want meat and I want it at the top.
agree.
 
> 3.   Summaries?  This is useless. I want facts, not aggregates.  Knowing
> that 5 files were changed is useless.  I need to know WHICH 5 files
> and what was changed, in one glance.  I often get good reports when 1,000
> files were changed and bad reports when only 1 file is changed.   That
> is not useful information.
agree!

> 4. Then WAY too much details.  I already get reports that are 100k in
> the OLD format. The new format is WAY to much stuff to wade through.
> It takes 20 lines to provide almost the same detail as the OLD report does
> in one line.  Multiply by 1000 changed files and the results are
> horrendous.  Looking at 1 change to a screen is just not possible.
agree.

> > Can you point out what about this report is lacking? I'm happy to hack up
> > the format until we all agree it is as concise as possible.
> It is lacking a consistent focus on the important details in a compact
> format.  The pseudo "ls" format of the top half is the old report
> is the ideal starting point.  Any sysadmin worth his salt can grok
> a huge "ls" in seconds and pick out the important stuff.  It is a
> format that he already feels in his bones.  Learning UNIX is learning
> not to reinvent wheels.
> Instead of seeing what I need in one or two screens I now need
> to read 20 or 40 screens.  This is not good.  It makes it very
> hard to eyeball the type and scope of changes.  If someone has changed
> a lot in the system then the new format is just HUGE.
> If some people like the new format then keep it, but a LOT of us
> have many years of experience with the old one and are having a hard
agree.

The main (& the HUGEST)  bad changes in report was tat I CAN'T know from
it what it WAS & what it NOW. I _NEED_ this information for all parameters
set to be checked. 

What da hell means /bin/ls has changed? What of MANY parameters changed. &
HOW them where changed. :? I've some scripts running from crond. I've new
installed software. I've a huge .bash_history & so on. So many things may
cause changes but only a small amount are illegal changes that tripwire
should track. Instead of showing the DETAILED subject of changes new
version just gives me a list of files. Some day I see thousands of files &
what? I should WASTE my time to dig EACHE ONE of these THOUSANDS files &
investigate what was the subject of reporting that change has happen. 

These new reports are USELESS. I decided to remove tripwire because old
one with fine reports has bugs with non-"C"-locale-based file names & the
new one is just a WASTE of CPU cicles & human reading time. Anyway I'm
steel on the announce list - hope somewhen the reports will go to the
better view? :?

-- 
Bye.Olli
MISiS Telecommunications
phone:   +7(095)955-0087