Vijay Avarachen posted a great tip on Linux Journal’s website. In the article Vijay posted, he shows how to use rpm along with the verify option to list files that have changed:
$ rpm -qa | xargs rpm --verify --nomtime | less
S.5...... c /etc/yum.repos.d/fedora.repo
..5...... c /etc/pki/nssdb/secmod.db
S.5...... /etc/cron.d/smolt
....L.... c /etc/pam.d/fingerprint-auth
....L.... c /etc/pam.d/password-auth
....L.... c /etc/pam.d/smartcard-auth
....L.... c /etc/pam.d/system-auth
prelink: /usr/lib64/libopenrawgnome.so.1.4.0: prelinked file was modified
S.?...... /usr/lib64/libopenrawgnome.so.1.4.0
....L.... /usr/lib64/libbind9.so.50
....L.... /usr/lib64/liblwres.so.50
.M....G.. /var/cache/ccache
Yum has a similar capability, which can be accessed through yum-plugin-verify plugin. This plugin adds the verify-all and verify-rpm options, which can be used to list files that have changed (you will need to edit /etc/yum/pluginconf.d/verify.conf to make the plugin as useful as the rpm –verify option). Good stuff!