diff -Nur -x '*.orig' -x '*.rej' smeserver-audittools-0.0.2/root/sbin/e-smith/audittools/events mezzanine_patched_smeserver-audittools-0.0.2/root/sbin/e-smith/audittools/events
--- smeserver-audittools-0.0.2/root/sbin/e-smith/audittools/events	1970-01-01 10:00:00.000000000 +1000
+++ mezzanine_patched_smeserver-audittools-0.0.2/root/sbin/e-smith/audittools/events	2008-01-09 11:48:06.000000000 +1100
@@ -0,0 +1,69 @@
+#!/usr/bin/perl -w
+
+#----------------------------------------------------------------------
+# copyright (C) 2006 Gordon Rowell <gordonr@gormand.com.au>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307  USA
+#----------------------------------------------------------------------
+
+use strict;
+use warnings;
+
+use RPM2;
+use File::Find;
+use File::Path;
+use File::stat;
+
+# Files not owned by RPMs
+# Files modified since install by RPM
+# events from "non-standard" RPMs
+
+use RPM2;
+my $rpm2 = RPM2->open_rpm_db();
+
+find({ wanted => \&events }, "/etc/e-smith/events");
+
+sub events
+{
+    return unless -f;
+
+    my $template = $File::Find::name;
+
+    my $status = rpm_status(name => $File::Find::name);
+
+    return if ( $status eq "OWNED_BY_RPM");
+
+    print "$File::Find::name: $status\n";
+}
+
+sub rpm_status
+{
+    my (%options) = @_;
+
+    my @rpms = $rpm2->find_by_file($options{name});
+
+    return "MANUALLY_ADDED" unless (@rpms);
+
+    return "MULTIPLE_RPM_OWNERS " . join(", ", map { $_->as_nvre } @rpms)
+        if (@rpms >= 2);
+
+    my $install_time = $rpms[0]->tag("INSTALLTIME");
+
+    my $st = stat($options{name}) or die "Couldn't stat $options{name}: $!";
+
+    return "MODIFIED " . $rpms[0]->as_nvre if ($st->mtime > $install_time);
+
+    return "OWNED_BY_RPM";
+}