# $Id: FAQ,v 1.2 92/11/03 13:34:43 genek Exp $

#
# FAQ for Tripwire
#

    This file answers frequently asked questions about Tripwire.
The first section of the file covers Tripwire concepts and design,
while the second section addresses troubleshooting.

Concepts:
=========

Q:	Why doesn't Tripwire ever traverse filesystems?

A:	This is a feature.  This behavior makes it possible to put a
	directory (e.g., '/') in your tw.config file, and you won't
	have to worry whether it will traverse all the locally-mounted
	filesystems.


Q:	What is the difference between pruining an entry in your 
	tw.config file (via "!") and ignoring everything (via the "E" 
	template)?

A:	Ignoring everything in a directory still monitors for added 
	and deleted files.  Pruning a directory will prevent Tripwire
	from even looking in the specified directory.


Q:	Tripwire runs very slowly.  What can I do to make it run 
	faster?

A:	You can modify your tw.config entries to skip the Snefru 
	signatures by appending a "-2" to the ignore flags.  Or you can
	run tell Tripwire at run-time to skip Snefru by:
		
			tripwire -i 2
			
	This computationally expensive operation may not be needed for 
	many applications.  (See README section on security vs. 
	performance trade-offs for further details.)

Troubleshooting:
================

Q: 	When running Tripwire in Integrity Checking mode, Tripwire
	fails when it tries to find a file with a name consisting of
	thousands of '/'s.  What went wrong?

A:	Your setting for the #define DIRENT value in your conf-<os>.h
	file is probably set wrong.  Trying switching the setting and
	see if the problem goes away.  (i.e., switch #define to 
	#undef, or vice versa.)


Q:	I have /tmp in my tw.config file, but none of the files in 
	the directory are being read by Tripwire.  What's going on?

A:	Check to see that your /tmp directory isn't a symbolic link
	to another filesystem.  When recursing down into directories,
	Tripwire never traverses symbolic links or enters another
	filesystem.  


Gene & Gene
Kim  & Spafford

November 2, 1992
(genek@mentor.cc.purdue.edu)
(spaf@cs.purdue.edu)
	
