aide(1)
Advanced Intrusion Detection Environment (AIDE) checks file integrity by comparing current file attributes against a previously generated database.
Synopsis
aide [OPTION]... [--check|--init|--update]Description
AIDE is a file integrity checker that maintains a database of file attributes (permissions, checksums, ownership, timestamps) and detects unauthorized changes. It's commonly used to monitor system files and directories for tampering or corruption.
AIDE creates an initial database with --init, then uses --check to compare current files against that baseline. The --update option creates a new baseline while keeping the old one for comparison.
Common options
| Flag | What it does |
|---|---|
-i, --init | Initialize the AIDE database (create new baseline from scratch) |
-c, --check | Check current system against the database for changes |
-u, --update | Update the database with current file states while preserving old database for comparison |
-C, --config=FILE | Specify alternate configuration file (default: /etc/aide/aide.conf) |
-B, --database=DIR | Specify database directory location |
-r, --report=FILE | Write detailed report to specified file |
-v, --verbose | Print verbose output during execution |
-q, --quiet | Suppress unnecessary output |
--config-check | Check configuration file syntax and exit |
-l, --limit=NUM | Limit reported changes to NUM items per file |
Examples
Create initial AIDE database from current filesystem state
aide --initCheck system for file changes since last database creation
aide --checkRun integrity check and save full report to file
aide --check > aide_report.txt 2>&1Initialize database using custom configuration file
aide -C /etc/aide/custom.conf --initCheck system and show only newly added files
aide --check | grep addedUpdate database with new baseline while preserving old database for comparison
aide --updateValidate AIDE configuration file syntax without running checks
aide --config-checkRun check and write detailed report to specified path
aide -c -r /var/log/aide/last_check.txt