The Audit command produces output that describes differences between two manifests on a per-file basis.
filename attribute control:xxxx test:yyyy
Name of the file that differs between control-manifest and test-manifest. For file names that contain embedded whitespace or newline characters, see Quoting Syntax.
The name of the file attribute that differs between the manifests that are compared. xxxx is the attribute value from control-manifest, and yyyy is the attribute value from test-manifest. When discrepancies for multiple attributes occur for the same file, each difference is noted on a separate line.
The following default output shows the attribute differences for the /etc/passwd file. The output indicates that the size, mtime, and contents attributes have changed.
/etc/passwd: size control:74 test:81 mtime control:3c165879 test:3c165979 contents control:daca28ae0de97afd7a6b91fde8d57afa test:84b2b32c4165887355317207b48a6ec7