aide(1) - Linux man page
Name
aide - Advanced Intrusion Detection EnvironmentSynopsis
aide [parameters] commandDescription
aide is an intrusion detection system for checking the integrity of files.Commands
- --check, -C
- Checks the database for inconsistencies. You must have an initialized database to do this. This is also the default command. Without any command aide does a check.
- --init, -i
- Initialize the database. You must initialize a database and move it to the appropriate place before you can use the --check command.
- --update, -u
- Checks the database and updates the database non-interactively. The input and output databases must be different.
- --compare
- Compares two databases. They must be defined in configfile with database=<url> and database_new=<url>.
- --config-check, -D
- Stops after reading in the configuration file. Any errors will be reported. If aide was compiled with the dq--with-dbhmackeydq option, a hash for the config file will be calculated. See the aide manual for more information.
Parameters
- --config=configfile , -c configfile
- Configuration is read from file configfile instead of "./aide.conf". Use '-' for stdin.
- --before=dqconfigparametersdq , -B dqconfigparametersdq
- These configparameters are handled before the reading of the configuration file. See aide.conf (5) for more details on what to put here.
- --after=dqconfigparametersdq , -A dqconfigparametersdq
- These configparameters are handled after the reading of the configuration file. See aide.conf (5) for more details on what to put here.
- --verbose=verbosity_level,-Vverbosity_level
- Controls how verbose aide is. Value must [0-255]. The default is 5. With no argument Value is set to 20. This parameter overrides the value set in a configuration file.
- --report=reporter,-r reporter
- reporter is a URL which tells aide where to send it's output. See aide.conf (5) section URLS for available values.
- --version,-v
- aide prints out its version number
- --help,-h
- Prints out the standard help message.
Diagnostics
Normally, the exit status is 0 if no errors occurred. Except when the --check command was requested, in which case the exit status is defined as:- 1 * (new files detected?) +
- 2 * (removed files detected?) +
- 4 * (changed files detected?)
- 2 * (removed files detected?) +
Additionally, the following exit codes are defined for generic error conditions:
- 14 Error writing error
- 15 Invalid argument error
- 16 Unimplemented function error
- 17 Invalid configureline error
- 18 IO error
- 19 Version mismatch error
- 15 Invalid argument error