Tripwire

# Add essential proc subs: /proc/sys, /proc/cpuinfo, /proc/modules

twadmin -m P /etc/tripwire/twpol.txt
tripwire --init

tripwire --check [--email-report]

tripwire --update --twrfile /var/lib/tripwire/report/servername-YYYYMMDD-HHMMSS.twr

Update script with last report:

lastfilename=(`ls -Art  /var/lib/tripwire/report/ | tail -n 1`)
sudo tripwire --update --twrfile /var/lib/tripwire/report/${lastfilename}