In the past year, the authors have collected feedback from numerous active sites reporting the effectiveness of Tripwire in detecting changed files on their systems. Several cases have been reported to us of Tripwire finding unauthorized intruders. All these classes of stories seem to validate our concept of this integrity checking tool. The last two classes of use have proven to be surprising applications of Tripwire that we did not envision at the time we wrote it . According to system administrators, the ability to update Tripwire databases is among its most important features.
Files seem to change for many unforeseen reasons.
Consequently , the database is updated regularly. Gene H. Kim and Eugene H. Spafford. Usenix, April 1994.