The output of tripwire is very difficult to deal with. It makes for pretty reports, and yes I know there's an XML option, but I just wanted a very simple output that's easy to read. Enter sed for the solution:
/usr/sbin/tripwire --check | sed '/:$/h;/^".*"$/!d;G;s/^"\(.*\)"\n\(.*\)/\2\1/' | sort
Added:/etc/rc.d/init.d/0
Added:/etc/rc.d/init.d/atop
Added:/etc/rc.d/init.d/blk-availability
Added:/etc/rc.d/init.d/boundary-meter
Added:/etc/rc.d/init.d/cloud-config
Modified:/proc/self
Modified:/usr/sbin/accton
Modified:/usr/sbin/addgnupghome
Modified:/usr/sbin/alternatives
Modified:/usr/sbin/anacron
Modified:/usr/sbin/apachectl
Removed:/usr/sbin/makewhatis
Removed:/usr/sbin/tunelp
Removed:/usr/lib/rpm/fileattrs/maven.attr
Removed:/usr/lib/rpm/fileattrs/osgi.attr
