Local AIDE Checks

To perform a filesystem check, proceed as follows:

  1. Rename the database:

    mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db
  2. After any configuration change, you always have to reinitialize the AIDE database and subsequently move the newly generated database. It is also a good idea to make a backup of this database. See Section 12.2, “Setting Up an AIDE Database” for more information.

  3. Perform the check with the following command:

    aide --check

If the output is empty, everything is fine. If AIDE found changes, it displays a summary of changes, for example:

aide --check
AIDE found differences between database and filesystem!!

Summary:
  Total number of files:        1992
  Added files:                  0
  Removed files:                0
  Changed files:                1 

To learn about the actual changes, increase the verbose level of the check with the parameter -V. For the previous example, this could look like the following:

aide --check -V
AIDE found differences between database and filesystem!!
Start timestamp: 2009-02-18 15:14:10

Summary:
  Total number of files:        1992
  Added files:                  0
  Removed files:                0
  Changed files:                1


---------------------------------------------------
Changed files:
---------------------------------------------------

changed: /etc/passwd

--------------------------------------------------
Detailed information about changes:
---------------------------------------------------


File: /etc/passwd
  Mtime    : 2009-02-18 15:11:02              , 2009-02-18 15:11:47
  Ctime    : 2009-02-18 15:11:02              , 2009-02-18 15:11:47

In this example, the file /etc/passwd was touched to demonstrate the effect.