A sample baseline might consist of:
A list of software packages installed, (rpm -qa on linux), see the pkginfo command for Solaris.
The suid file list.
Disk partition information, contained in the /etc/fstab and via the df command.
The server hardware list, useful info from the /var/dmesg file in linux or the Sysinfo utility for commercial unicies.
Copies of all config files living in the /etc and /usr/local/etc directories.
Crontab files.
Lists of custom compiled software.
Config files for custom installed software.
The server log contains notes about any significant changes which are made by an administrator. Some changes cause an update of baseline documents as well.
How do these documents help?
Example:
One morning you notice a tripwire claiming a change made to the Apache config file. The Apache config file can be quite large. If you have been keeping a server log you can verify that you changed the file at the correct date and time listed in your tripwire report, and convince yourself that the changes made match up with the new file size reported. If you are unconvinced you can check against the baseline Apache config file.