NAME

       aide - Advanced Intrusion Detection Environment

SYNOPSIS

       aide [parameters] command

DESCRIPTION

       AIDE is an intrusion detection system for checking the integrity of files.

COMMANDS

       --check, -C
              Checks the database for inconsistencies. You must have an initialized database to do this. This is
              also the default command. Without any command aide does a check.

       --init, -i
              Initialize the database. You must initialize a database and  move  it  to  the  appropriate  place
              before you can use the --check command.

       --update, -u
              Checks  the  database  and updates the database non-interactively.  The input and output databases
              must be different.

       --compare, -E
              Compares  two  databases.  They  must  be  defined  in  config  file   with   database=<url>   and
              database_new=<url>.

       --config-check, -D
              Stops  after reading in the configuration file. Any errors will be reported.  If aide was compiled
              with the "--with-dbhmackey" option, a hash for the config file will be calculated.  See  the  AIDE
              manual for more information.

PARAMETERS

       --config=configfile , -c configfile
              Configuration is read from file configfile instead of "./aide.conf". Use '-' for stdin.

       --limit=REGEX , -l REGEX
              Limit command to entries matching REGEX. Note that the REGEX only matches at the first position.

              Example
                 Only  check  and  update  the  database  entries  matching /etc (i.e. the /etc directory) while
                 leaving all other entries unchecked and unchanged:

                    aide --update --limit /etc

       --before="configparameters" , -B "configparameters"
              These configparameters are handled before the reading of the configuration file. See aide.conf (5)
              for more details on what to put here.

       --after="configparameters" , -A "configparameters"
              These  configparameters are handled after the reading of the configuration file. See aide.conf (5)
              for more details on what to put here.

       --verbose=verbosity_level,-Vverbosity_level
              Controls how verbose aide is. Value must [0-255]. The default is 5. With no argument Value is  set
              to 20. This parameter overrides the value set in a configuration file.

       --report=reporter,-r reporter
              reporter  is  a URL which tells aide where to send it's output. See aide.conf (5) section URLS for
              available values.

       --version,-v
              aide prints out its version number

       --help,-h
              Prints out the standard help message.

DIAGNOSTICS

       Normally, the exit status is 0 if no errors occurred. Except when  the  --check,  --compare  or  --update
       command was requested, in which case the exit status is defined as:

       1 * (new files detected?)     +

       2 * (removed files detected?) +

       4 * (changed files detected?)

       Since  those  three cases can occur together, the respective error codes are added. For example, if there
       are new files and removed files detected, the exit status will be 1 + 2 = 3.

       Additionally, the following exit codes are defined for generic error conditions:

       14 Error writing error

       15 Invalid argument error

       16 Unimplemented function error

       17 Invalid configureline error

       18 IO error

       19 Version mismatch error

NOTES

       Please note that due to mmap issues, aide cannot be terminated with SIGTERM. Use SIGKILL to terminate.

       The checksums in the database and in the output are by default base64  encoded  (see  also  report_base16
       option).  To decode them you can use the following shell command:

       echo <encoded_checksum> | base64 -d | hexdump -v -e '32/1 "%02x" "\n"'

FILES

       /etc/aide/aide.conf
              Default aide configuration file.

       /etc/aide/aide.conf.d
              Config  snippets  which  are  automatically  concatenated  to  the  configuration  file by update-
              aide.conf. This is a Debian extension.

       aide.db
              Default aide database.

       aide.db.new
              Default aide output database.

SEE ALSO

       aide.conf(5) manual.html

BUGS

       There are probably bugs in this release. Please report them at https://github.com/aide/aide/issues and to
       the Debian BTS.

DISCLAIMER

       All  trademarks  are  the  property of their respective owners.  No animals were harmed while making this
       webpage or this piece of software. Although some pizza delivery guy's feelings were hurt.