Detect File Changes with AIDE Host IDS on VPS

June 2026 · 7 min read

AIDE (Advanced Intrusion Detection Environment) creates a fingerprint database of all files on your VPS. When you run a check, it compares files against the baseline and immediately alerts you if any files have been modified, added, or deleted. This helps detect rootkits, backdoors, or unauthorized access attempts before it's too late.

Install AIDE

sudo apt update
sudo apt install aide aide-common -y

# Verify installation
aide --version

Configure AIDE (/etc/aide/aide.conf)

sudo nano /etc/aide/aide.conf

# Database location
database_in=file:/var/lib/aide/aide.db.gz
database_out=file:/var/lib/aide/aide.db.new.gz
database_new=file:/var/lib/aide/aide.db.new.gz
gzip_dbout=yes

# Rules definitions
FIPSR = p+i+n+u+g+s+m+S+sha512+acl+selinux+xattrs

# Monitor critical system files
/bin FIPSR
/sbin FIPSR
/usr/bin FIPSR
/usr/sbin FIPSR
/etc FIPSR
/lib FIPSR

# Exclude log files and temporary files
!/var/log
!/tmp
!/run
!/proc
!/sys
!/dev

Create Initial Database (Baseline)

# Create baseline database (takes 5-15 minutes)
sudo aide --init

# Copy to active database
sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

# Check database size
ls -lh /var/lib/aide/

Run Check and Review Results

# Compare against baseline
sudo aide --check

# You'll see:
# Added entries:   Files new and not in baseline
# Removed entries: Files that were deleted
# Changed entries: Files modified (hash changed)

Update Database After Intentional Changes

# After apt update/upgrade, update the database
sudo apt upgrade
sudo aide --update
sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Set Up Daily Cron Report

sudo nano /etc/cron.daily/aide-check

#!/bin/bash
REPORT=$(aide --check 2>&1)
if echo "$REPORT" | grep -q "changed\|added\|removed"; then
    echo "$REPORT" | mail -s "AIDE Alert: File Changes on $(hostname)" [email protected]
fi

sudo chmod +x /etc/cron.daily/aide-check

Verify AIDE is Working Correctly

# Test: Create a file in the monitored area
sudo touch /etc/aide-test-file

# Run check to see if it detects the change
sudo aide --check 2>&1 | grep -i "added\|changed"

# Delete the test file
sudo rm /etc/aide-test-file

# Update database to match current state
sudo aide --update
sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Common Issues & Troubleshooting

AIDE --init Takes Too Long

For servers with many files, reduce the scope in aide.conf to speed things up:

# Exclude unnecessary directories
!/home
!/opt
!/var/lib/docker

Too Many False Alarms (Files Changing Daily)

Log files, timestamps, and PID files change constantly. Exclude them in the configuration:

!/var/log
!/var/run
!/var/cache
!/tmp

Database File Corrupted After Power Failure

Rebuild from backup or reinitialize:

# Rebuild database
sudo aide --init
sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

AIDE is Slow or Uses 100% CPU for Long Periods

Reduce rule complexity or monitor only critical directories:

# Use a lighter rule set
LIGHT = p+i+n+u+g+s+sha256
/etc LIGHT
/bin LIGHT

Frequently Asked Questions

How is AIDE different from Tripwire?

Tripwire is a commercial product with more advanced features. AIDE is free and open-source, making it simpler to use. For a personal VPS, AIDE is sufficient. Tripwire is better suited for organizations that need compliance reporting.

Can AIDE prevent rootkits?

AIDE detects that files have changed but doesn't prevent rootkits from entering. If a rootkit gets in and modifies files before AIDE checks, AIDE will alert you. However, if the rootkit also modifies the AIDE database itself, detection becomes impossible.

How often should I run AIDE checks?

Daily (cron.daily) is sufficient for most servers. Servers with compliance requirements may need hourly checks, but you'll need to handle increased false positives.