In the following example, blacklight is initialised and then run. When run, it finds some files have changed timestamps - these are normal. However /etc/passwd has also changed - which we might not have expected. Configuration of blacklight is via two variables at the top of the script. # ./blacklight -i Initialising Database... -rw-r--r-- 1 root other 312783 Nov 29 00:19 /etc/blacklight.db Done. # ./blacklight -v Filesystem Checks, Checking attributes... File attibute change, now: prw------- 1 root root 0 Nov 28 23:58 /etc/saf/_sacpipe old: prw------- 1 root root 0 Nov 28 23:23 /etc/saf/_sacpipe -------- File attibute change, now: prw------- 1 root root 0 Nov 28 23:58 /etc/saf/zsmon/_pmpipe old: prw------- 1 root root 0 Nov 28 23:23 /etc/saf/zsmon/_pmpipe -------- File attibute change, now: -r--r--r-- 1 root sys 1149 Nov 28 23:25 /etc/passwd old: -r--r--r-- 1 root sys 1143 Nov 15 00:37 /etc/passwd -------- File attibute change, now: prw------- 1 root root 0 Nov 28 23:40 /etc/utmppipe old: prw------- 1 root root 0 Nov 28 23:13 /etc/utmppipe -------- File attibute change, now: -rw-r--r-- 1 root other 312783 Nov 28 23:25 /etc/blacklight.db old: -rw-r--r-- 1 root other 94624 Nov 28 23:25 /etc/blacklight.db -------- Checking checksums... Checksum change, now: 3544324546 1149 /etc/passwd old: 2106710141 1143 /etc/passwd -------- Checksum change, now: 1685167234 312783 /etc/blacklight.db old: 1091766018 259036 /etc/blacklight.db -------- Done.