NAME¶

aide - Advanced Intrusion Detection Environment

SYNOPSIS¶

aide [parameters] command

DESCRIPTION¶

AIDE is an intrusion detection system for checking the integrity of files.

COMMANDS¶

--check, -C

Checks the database for inconsistencies. You must have an initialized database to do this. This is also the default command. Without any command aide does a check.

--init, -i

Initialize the database. You must initialize a database and move it to the appropriate place (see database_in config option) before you can use the --check command.

--dry-init, -n

Traverse the file system, match each file against the rule tree and report to stdout.

Neither reports nor the database are written in this mode.

To change the log level in this mode please use the --log-level command line parameter.

In this mode aide exits with status 0.

--update, -u

Checks the database and updates the database non-interactively. The input and output databases must be different.

--compare, -E

Compares two databases. They must be defined in config file with database=<url> and database_new=<url>.

--config-check, -D

Stops after reading in the configuration file. Any errors will be reported. To change the log level in this mode please use the --log-level command line parameter.

--path-check=[file_type:]path, -p [file_type:]path

Read configuration and match provided file_type (optional, default: f) and path against rule tree. See RESTRICTED RULES section in aide.conf (5) for supported file types). The path needs to be absolute.

To change the log level in this mode please use the --log-level command line parameter.

In this mode aide exits with status 0 if the file would be added to the tree, 1 if not and 2 if the file does not match a specified limit.

PARAMETERS¶

--config=configfile , -c configfile

Configuration is read from file configfile (see --version output for default value). Use '-' for stdin.

--limit=REGEX , -l REGEX

Limit command to entries matching REGEX. Note that the REGEX only matches at the first position.

aide --update --limit /etc

--before="configparameters" , -B "configparameters"

These configparameters are handled before the reading of the configuration file. See aide.conf (5) for more details on what to put here.

--after="configparameters" , -A "configparameters"

These configparameters are handled after the reading of the configuration file. See aide.conf (5) for more details on what to put here.

--log-level=log_level,-Llog_level

The log level to use (see aide.conf (5) for available log levels and more details). This overwrites the log_level value set in any configuration file.

--verbose=verbosity_level,-Vverbosity_level

Removed in AIDE v0.17, use log_level and report_level config options instead (see aide.conf (5) for details).

--version,-v

aide prints out its version number

--help,-h

Prints out the standard help message.

EXIT STATUS¶

Normally, the exit status is 0 if no errors occurred. Except when the --check, --compare or --update command was requested, in which case the exit status is defined as:

1 * (new files reported?) +

2 * (removed files reported?) +

4 * (changed files reported?)

Since those three cases can occur together, the respective error codes are added. For example, if there are new files and removed files reported, the exit status will be 1 + 2 = 3.

Additionally, the following exit codes are defined for generic error conditions:

14 Writing error

15 Invalid argument error

16 Unimplemented function error

17 Configuration error

18 IO error

19 Version mismatch error

20 EXEC error

21 File lock error

SIGNAL HANDLING¶

Please note that due to mmap issues, aide cannot be terminated with SIGTERM. Use SIGKILL to terminate.

SIGUSR1 toggles the log_level between current and debug level.

NOTES¶

The checksums in the database and in the output are by default base64 encoded (see also report_base16 option). To decode them you can use the following shell command:

echo <encoded_checksum> | base64 -d | hexdump -v -e '32/1 "%02x" "\n"'

FILES¶

See --version output for the default config file and the default database_in and database_out config values.

SEE ALSO¶

aide.conf(5)

BUGS¶

There are probably bugs in this release. Please report them at https://github.com/aide/aide/issues .

DISCLAIMER¶

All trademarks are the property of their respective owners. No animals were harmed while making this webpage or this piece of software. Although some pizza delivery guy's feelings were hurt.