FCHECK(8)

💖 FCHECK(8) — like, the IDS filesystem baseline integrity checker bestie 💖

okay so this is fcheck, a section 8 manual page from the User Contributed Perl Documentation corner of the world, and she is literally the friend who notices when someone moved one single thing on your shelf. no cap.

---

✨ NAME ✨

fcheck — IDS filesystem baseline integrity checker 🦋

🌸 SYNOPSIS 🌸

fcheck [OPTIONS]

that's it. that's the whole vibe. options go in, chaos detection comes out.

👑 OPTIONS 👑

The options to fcheck are defined below, bestie — read them all, no skipping:

• -a — Automatic mode, do all directories in configuration file. she handles the whole list herself, main character energy.
• -c — Create a new base line database for the given directory. this is you taking the "before" pic 📸
• -d — Directory names are to be monitored for changes also. yes queen, watch the folders too, not just the files.
• -f filename — Use alternate filename as the configuration file. like, "not that config, THIS config."
• -i — Ignore creation times, check permissions, adds, deletes only. chill mode. we don't care when it was born, only who can touch it and what showed up or left.
• -h — Append the $HOSTNAME to the configuration filename. now your config knows which machine it lives on 💅
• -l — Log information to logger rather than stdout messages. bye stdout, hello syslog.
• -r — Report mode, great for emailed status reports. perfect for when you want the receipts in your inbox 📩
• -s — Sign each file with a CRC/hash signature. digital fingerprints, obsessed.
• -v — Verbose mode, not used for report generation. she will tell you everything, but not in the report, okay?
• -x — eXtended unix checks, # of links, UID, GID, Major/Minor checks. the deep dive 🕵️♀️

💜 DESCRIPTION 💜

🦋 Overview 🦋

The fcheck utility is an IDS (Intrusion Detection System) which can be used to monitor changes to any given filesystem. yes bestie, an actual intrusion detection system. she's the group chat member who screenshots everything so nobody can lie later.

Essentially, fcheck has the ability to monitor directories, files or complete filesystems for any additions, deletions, and modifications. additions? deletions? modifications? she sees all three. it is configurable to exclude active log files — because log files are always doing the most and we're not going to fight them — and can be ran as often as needed from the command line or cron making it extremely difficult to circumvent. like, you literally cannot sneak past her. periodt.

🌈 Operation and Getting Started 🌈

Flag passing is a fairly simple process. no stress. Primarily you will be using two commands. One builds (or rebuilds) your baseline database files (system snapshots). The second runs in a scanning comparison mode.

"fcheck -ac"

Builds the baseline database. 📸

"fcheck -a"

Comparison scans the system against the baseline database.

For normal operation: Initially you will run fcheck by issuing the command "fcheck -ac" to create the initial baseline file used for comparison. Any runs after the creation of the basline will normally be with the following flags "fcheck "-a"" to scan for any system modifications.

After a scan is completed, you will probably want to have fcheck re-create its baseline database for the next comparison cycle. Otherwise you will be seeing every system modification since the last baseline re-build — and bestie, that's a lot of old news to scroll through. In other words, run the "fcheck -ac" command again.

(Advanced Note:) A more intensive system check would be accomplished by building your database to include GID/UID checks, directories, and CRC checks by using the following sample syntax:

"fcheck -cadsxlf /etc/fcheck/fcheck.cfg"

And provide periodic integrity scans from cron by using the following sample syntax:

"fcheck -adsxlf /etc/fcheck/fcheck.cfg"

ok quick glow-up note: that -x is doing a LOT of heavy lifting in these examples, so make sure your config actually vibes with extended checks before you go full send 🔥

🫶 AUTHOR 🫶

Author: Copyright (C) 1996 Michael A. Gumienny <gumienny@hotmail.com> 🎀

Debianized by: Graham Simpson <gsi@eggconnect.net> ✨

🎀 SEE ALSO 🎀

Please also refer to the excellent README and INSTALL instructions provided with the package /usr/share/doc/fcheck. fr fr, go read them, they're giving very helpful.

---

and that's the page, bestie 💖 this one's perl v5.40.1, dated 2026-01-20, filed under FCHECK(8) — go forth and baseline your whole life, you iconic little sysadmin 🧚‍♀️⭐