Puppet

Used to be you could passively monitor files and just log when they changed, a la tripwire, but that feature seems to have gone away sometime recently without anyone noticing.

I think the mechanism before was something like:

file { "/tmp/foo": check => checksum }

I’ve been thinking of refactoring the ‘Checksum’ parameter to make it into a parameter rather than a property, like I recently did with ‘source’, and this might be a good time to do so.

This feature has been coming up a ton recently, though, as people look more at using Puppet for compliance and security auditing.