Freedom251 › File Integrity Monitoring Software

Vigil Baseline

Free plan Linux

Visit Vigil Baseline Alternatives Pricing

What Vigil Baseline is

Vigil Baseline is a free file integrity monitor for one Linux desktop. It creates a known-good snapshot of watched files, recording details such as hashes, permissions, ownership, inode, capabilities, extended attributes, and SELinux or AppArmor context. It watches filesystem changes with Linux fanotify and falls back to inotify, then compares detected changes with the saved baseline. BLAKE3 hashing and an HMAC-chained audit log preserve change records. Vigil stays silent unless a watched file changes; desktop notifications through notify-send are optional. FID-capable Linux 5.1+ kernels support real-time coverage across event classes, while scheduled scans detect some event types on older kernels. The interactive welcome configuration takes about ninety seconds and can be rerun. The vigil-baseline package is installed with apt or dnf after repository setup, and signed packages and repository metadata are delivered through the package manager. Its systemd unit is described as hardened. Signal socket and webhook are its integration points, disabled by default and outbound-only when enabled. Vigil does not kill, quarantine, or block processes or files, and is not an EDR. It is intended for one operator on a Linux desktop or laptop, not for fleets or central reporting.

Who it suits

Vigil suits an individual operator who wants to monitor file integrity on a Linux desktop or laptop, including Arch, Debian, Ubuntu, or Fedora. It is aimed at desktop use rather than server, container, fleet, or centrally managed deployments.

What it does well

Free under GPL v3.0 for most users.
Records file metadata alongside hashes in a known-good snapshot.
Uses fanotify with an inotify fallback.
Keeps an HMAC-chained audit log of changes.
Optional desktop alerts through notify-send.
Signed packages and repository metadata arrive through the package manager.

What to know first

Designed for one Linux desktop, without fleet management or central reporting.
Does not kill, quarantine, or block files or processes.
Older kernels rely on scheduled scans for some event types.
Signal socket and webhook are disabled by default.

Limits

The free Vigil Baseline plan is for one Linux desktop and does not include fleet management or central reporting. It does not kill, quarantine, or block processes or files; on older kernels, scheduled scans detect some event types.

Plans

Plan	Billed and limits	Price
Vigil Baseline	GPL v3.0 for most users · commercial license available for proprietary use	Free

As github.com lists them, read 7 Oct 2026. The maker's own page has the final word.

Getting started

Set up the Vigil package repository.
Install vigil-baseline with apt or dnf.
Run the interactive welcome configuration; it takes about ninety seconds and can be rerun.
Optionally enable desktop notifications through notify-send.

Verdict

Choose Vigil Baseline if you want a free file integrity monitor for a single Linux desktop, with a saved baseline and an audit trail for changes. Look elsewhere if you need automatic threat response, fleet management, or central reporting.

Questions

What does Vigil Baseline cost?

The Vigil Baseline plan is free. It is GPL v3.0 for most users, with a commercial license available for proprietary use.

Which operating systems does it support?

It supports Linux desktop distributions, including Arch, Debian, Ubuntu, and Fedora.

How do I install Vigil Baseline?

After repository setup, install the vigil-baseline package with apt or dnf. Packages and repository metadata are signed, and updates arrive through the package manager.

Does Vigil respond automatically to changes?

No. It records changes and can send optional desktop notifications, but it does not kill, quarantine, or block processes or files.

Does it have integrations?

The project identifies a signal socket and webhook as its integration points. Both are disabled by default and outbound-only when enabled.

Who makes Vigil Baseline, and what is its license?

The repository identifies lousclues as the project maker and Louis Nelson Jr. as the copyright holder. The source is offered under GNU GPL v3.0 only or a commercial license.

Facts from Vigil Baseline's own pages

Audit trail: Changes are recorded in a crash-safe write-ahead log and an HMAC-chained audit log. · github.com, 7 Oct 2026
Baseline: It records file hashes, permissions, ownership, inode, capabilities, extended attributes, and SELinux or AppArmor context in a known-good snapshot. · github.com, 7 Oct 2026
Daemon security: The systemd unit is described as hardened with MemoryMax, PrivateTmp, NoNewPrivileges, and minimal capabilities. · vigilbaseline.com, 7 Oct 2026
Deployment limits: The project says it is for one Linux desktop and does not provide fleet management or central reporting. · github.com, 7 Oct 2026
File watching: It watches filesystem events through fanotify, with an inotify fallback, and compares events against the baseline. · github.com, 7 Oct 2026
Integrations: The README identifies a signal socket and webhook as the only integration points, both disabled by default and outbound-only when enabled. · github.com, 7 Oct 2026
Integrity records: It uses BLAKE3 hashing and an HMAC-chained audit log. · vigilbaseline.com, 7 Oct 2026
Kernel coverage: On FID-capable Linux 5.1+ kernels it supports real-time coverage across event classes; on older kernels scheduled scans detect some event types. · github.com, 7 Oct 2026
License: The source code is offered under GNU GPL v3.0 only or a commercial license. · github.com, 7 Oct 2026
Limitations: Vigil is not an EDR and does not kill, quarantine, or block processes or files. · vigilbaseline.com, 7 Oct 2026
Maker: The repository identifies Louis Nelson Jr. as the copyright holder and describes lousclues as the project maker. · github.com, 7 Oct 2026
Maker profile: The maker's site says Lou makes small software and lists Vigil as an active Linux file integrity monitor. · lousclues.com, 7 Oct 2026
Monitoring: It uses kernel fanotify with an inotify fallback to watch filesystem changes. · vigilbaseline.com, 7 Oct 2026
Network and telemetry: The project says it has no telemetry, auto-updates, or network calls. · vigilbaseline.com, 7 Oct 2026
No automatic response: Vigil does not kill processes, quarantine files, or block execution, and the README says it is not an EDR. · github.com, 7 Oct 2026
Notable limits: It is not designed for servers, headless hosts, containers, Kubernetes, fleets, multi-tenant systems, central reporting, or remote control. · github.com, 7 Oct 2026
Notifications: It stays silent unless a watched file changes and can send desktop notifications through optional notify-send. · vigilbaseline.com, 7 Oct 2026
Package installation: The installable package is named vigil-baseline and is installed with apt or dnf after repository setup. · vigilbaseline.com, 7 Oct 2026
Package signing: Packages and repository metadata are signed, and updates arrive through the package manager. · vigilbaseline.com, 7 Oct 2026
Publisher: The repository identifies Vigil Baseline as a lousclues project and names Louis Nelson Jr. in its copyright notice. · github.com, 7 Oct 2026
Purpose: Vigil Baseline is a file integrity monitor for one desktop Linux workstation that watches selected files and reports changes. · github.com, 7 Oct 2026
Setup: The interactive vigil welcome configuration takes about ninety seconds and can be safely rerun. · vigilbaseline.com, 7 Oct 2026
Supported audience: The project is intended for one human operator on a Linux desktop or laptop, including Arch, Debian, Ubuntu, Fedora, or a similar desktop distribution. · github.com, 7 Oct 2026
Supported use: The maker describes Vigil as a file integrity monitor for a Linux desktop, including desktop distributions such as Arch, Debian, Ubuntu, and Fedora. · github.com, 7 Oct 2026

Where Vigil Baseline stands on Freedom251

File Integrity Monitoring Software#16 of 34