What this module does #
File integrity monitoring (FIM) answers a very specific question: has anything changed on my server without my knowing? An intruder who manages to get in, a slip while editing a system file, or an unexpected update always leave the same trace: files that appear, disappear or change.
The aide module relies on AIDE (Advanced Intrusion Detection Environment) to detect exactly that. Its way of working has three pieces: first it stores a baseline, a reference snapshot with the hash and attributes of every watched file; then it checks the current state against that snapshot and summarizes for you what has been added, deleted or modified; and when those changes are legitimate (for example after an update), you accept the current state as the new baseline so they stop showing up as alerts.
A check only makes sense if the baseline reflects a trusted state. Generate or accept the baseline right after installing and configuring the server, when you know it is clean. From then on, every check compares against that starting point.
Common tasks #
Pick what you want to do. Each recipe comes with the command already written — just click Copy and paste it into your terminal.
1
Check whether anything has changed
Compares the current system against the baseline and summarizes the changes.
Connect over SSH to your server with the ubuntu user.
Run the check. You will see a count of added, deleted and changed files:
$ sudo imaxe aide checkNeed it for a script or a dashboard? Ask for the output in JSON:
$ sudo imaxe aide check --json2
See the detail of the last check
Shows which exact files were added, deleted or changed.
After a check, review the result in a readable form, with the list of affected files:
$ sudo imaxe aide report3
See the overall status
At a glance: whether there is a baseline, when the last check ran and whether changes are pending.
Check the module's status summary:
$ sudo imaxe aide statusAlso available in JSON to plug into your monitoring:
$ sudo imaxe aide status --jsoncheck ran, whether there are pending changes and whether the scheduled check is active.4
Accept the changes as normal
Sets the current state as the new reference snapshot.
Once you have reviewed the report and the changes are legitimate, accept the current state as the new baseline:
$ sudo imaxe aide update-baselinecheck compares against this new reference.Running update-baseline makes the detected changes trusted forever. If something malicious were among them, it would be "whitewashed". Always review the report before updating, and do so only when you trust the state of the system.
Synopsis #
imaxe aide <subcommand> [flags]All subcommands require root privileges (use sudo) because AIDE reads protected system files and its database lives in restricted paths. Add --json to check or status to get machine-readable output, suitable for scripting and monitoring.
Subcommands #
| Subcommand | What it does | Relevant flags |
|---|---|---|
| check | Checks integrity against the baseline and summarizes changes by type (added, deleted, changed). | --json |
| report | Shows the last check in a readable form, with the list of affected files. | — |
| status | Status: baseline present, last check, pending changes and scheduled check. | --json |
| update-baseline | Accepts the current state as the new baseline (runs aide --update and activates the new DB). | — |
Arguments and flags #
| Flag | Type | Default | Description |
|---|---|---|---|
| --json | bool | false | On check and status, emits the result as structured JSON on stdout, suitable for scripting and monitoring. |
The report and update-baseline subcommands take no flags: they always operate on the last check and the current baseline, respectively.
Files and paths #
| Path | Contents |
|---|---|
| /etc/imaxe/aide.yml | Module configuration: check options, such as the list of affected files in addition to the counters. |
Example of aide.yml:
check:
# Listar los ficheros afectados en `check` (además de los contadores).
list_files: trueExit codes and logs #
Each run returns a code you can check with echo $? — useful for chaining in scripts or triggering alerts:
Follow the module's log while you debug:
$ sudo journalctl -u imaxe-aide -fTroubleshooting #
| Symptom | Likely cause | Fix |
|---|---|---|
| It returns NOBASE (code 4) | There is no baseline on the system yet. | Generate a reference snapshot with update-baseline when the server is clean. |
| It returns CHANGES (code 3) | There are files added, deleted or modified since the baseline. | Review the detail with report; if they are legitimate, accept them with update-baseline. |
check takes a long time | AIDE recomputes the hash of many files; this is normal on the first run. | Let it finish. Later check runs are faster. |
| Every update triggers changes | The baseline fell out of date after applying system patches. | After reviewing the report, run update-baseline to set the new trusted state. |
Stuck with the Integrity module?
Write to us with the output of «imaxe <module> status --json» and we'll get back to you fast.