By the use of tripwire it is possible to observe the filesystem. tripwire generates a database, controlled by a configuration file, of all files, their checksums, etc. and it reports changes.
The location of the binary is /var/adm/tripwire/bin/tripwire.
A configuration example can be found at /usr/doc/packages/tripwire.
Tripwire wants its configurationfile to be found at /var/adm/tripwire/tw.config. The database has to be saved at /var/adm/tripwire/db.