BART 的简单使用方法!

BART是在文件系统级的文件跟踪工具。使用BART工具使你能快速、容易和可靠地得到系统中的软件构成信息。使用BART能很大程度地减少网络系 统的管理成本。BART能够在目标系统软件目录的文件层执行检查操作。该实用程序可用于收集有关系统已安装了哪些内容的信息。BART还使你能够对已安装 的系统及系统内容随时间的变化情况进行比较。

举例说明：

# bart
Usage:
        bart create [-n] [-R root] [-r rules|-]
        bart create [-n] [-R root] [-I | -I filelist]
        bart compare [-r rules|-] [-i keywords] [-p] control-manifest test-manifest
# bart create -R /etc/nfs
! Version 1.0
! Tuesday, May 26, 2009 (16:48:01)
# Format:
#fname D size mode acl dirmtime uid gid
#fname P size mode acl mtime uid gid
#fname S size mode acl mtime uid gid
#fname F size mode acl mtime uid gid contents
#fname L size mode acl lnmtime uid gid dest
#fname B size mode acl mtime uid gid devnode
#fname C size mode acl mtime uid gid devnode
/nfslog.conf F 388 100644 user::rw-,group::r--,mask:r--,other:r-- 41f1979c 0 3 e2ddd392685bad129e23420728ed6b2b
# bart create -I /etc/passwd /etc/shadow
! Version 1.0
! Tuesday, May 26, 2009 (16:48:25)
# Format:
#fname D size mode acl dirmtime uid gid
#fname P size mode acl mtime uid gid
#fname S size mode acl mtime uid gid
#fname F size mode acl mtime uid gid contents
#fname L size mode acl lnmtime uid gid dest
#fname B size mode acl mtime uid gid devnode
#fname C size mode acl mtime uid gid devnode
/etc/passwd F 962 100644 user::rw-,group::r--,mask:r--,other:r-- 4a1c5d66 0 3 d64b8b1a8a8c71cd54becbd8844a53f6
/etc/shadow F 522 100400 user::r--,group::---,mask:---,other:--- 4a1c5d66 0 3 32e602b671e9f44c68b55ad20b371e25
# ls -al /etc/passwd
-rw-r--r--   1 root     sys          962 May 26 16:21 /etc/passwd
# ls -al /etc/shadow
-r--------   1 root     sys          522 May 26 16:21 /etc/shadow
# bart create -R /etc >system1.control.1    
# >/etc/henry
/etc/henry: cannot create
# rmdir /etc/henry
# bart create -R /etc >system1.control.1
# >/etc/henry
# bart create -R /etc >system1.control.2
# bart compare system1.control.1 system1.control.2
/henry:
  add

# rm /etc/henry
# bart create -R /etc >system1.control.3
# bart compare system1.control.2 system1.control.3
/henry:
  delete