On Sun, 2007-06-24 at 16:50 +0100, andy baxter wrote: > The difference is that: > > a) These all run on the live system they are trying to protect, Unless you configure them to only write to an offline mount point that is normally ro and only rw through external effort.... which is in Tripwire's best practices. -Jim P.