http://fileschanged.sourceforge.net/ ?sometime ago I came across a program that was able to monitor any directory and report if any file anywhere in that directory was modified
uses http://oss.sgi.com/projects/fam/
based on dnotify? inotify?
how big is something like tripwire?