Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteAIDE (Advanced Intrusion Detection Environment) creates a cryptographic baseline of selected files, then compares later scans with that baseline. On a VPS, install the distribution package, review aide.conf, initialize the database on a known-clean system, move the generated database to the configured database_in path, and schedule checks whose reports someone actually reads.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What AIDE does on a VPS
AIDE is a file-integrity checker, not a network firewall or a malware-removal tool. During initialization it records the attributes selected by your rules for monitored paths. Depending on those rules, attributes can include contents, checksums, permissions, ownership, size, timestamps, links and related metadata. A later aide --check compares the live filesystem with that baseline and reports additions, deletions and changes.
As an Amazon Associate I earn from qualifying purchases.
Recommended Free Tools
The operating sequence is important:
- Install AIDE from the VPS distribution’s package repository.
- Inspect the installed configuration and decide what the VPS should monitor.
- Initialize a database after the operating system and applications are in a known-clean state.
- Place the generated database where
database_inexpects it. - Run checks manually, investigate differences, and update the baseline only after authorized changes.
- Schedule recurring checks and deliver their reports to a monitored destination.
A check cannot be the first substantive operation. Without an initialized database at the configured input path, AIDE has nothing trustworthy against which to compare the filesystem.
Before installing: choose a clean baseline and a monitoring scope
Start from a known-clean VPS
The baseline is the reference for every subsequent report. Apply operating-system updates, install the services you intend to run, remove temporary administration files, and complete your initial configuration before creating it. If you suspect the VPS is already compromised, do not treat a newly generated local database as proof of cleanliness; investigate from a trusted recovery or forensic workflow first.
#1 Best Overall
Install only the software and services that belong on the server before initialization. A baseline created while packages are still being added will immediately produce expected changes, making it harder to recognize a genuinely unauthorized modification. Record when the baseline was created and which administrator approved it.
Decide what matters on this server
A practical VPS scope usually includes:
/etc, especially service configuration and access-control files.- SSH configuration and host keys under
/etc/ssh. - Privileged executables and other system binaries.
- Systemd unit files and service drop-ins.
- Scheduled-task directories such as system and administrator cron locations.
- Web-server configuration and the directories from which your applications are deployed.
Runtime state, caches, logs that change constantly, pseudo-filesystems and other volatile trees can create noise. Distribution defaults may already exclude some of them, but you should verify rather than assume. Monitoring every path with every attribute is not automatically safer: it can produce reports that conceal the few changes requiring attention.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Think about ownership and administrative boundaries as well. If an application directory is writable by a deployment account, monitor the code and configuration that should be immutable while deciding separately how routine releases will be approved and recorded. If a path is generated dynamically, determine whether a change there is actually a security signal before including it with a full-content rule.
Install the package for your Linux distribution
| Distribution family | Install command | Configuration and package locations to inspect |
|---|---|---|
| Debian or Ubuntu | sudo apt update |
/etc/aide/aide.conf, /etc/default/aide, /var/lib/aide, and commonly /etc/cron.daily/aide |
| RHEL 9 and compatible systems | sudo dnf install aide |
Commonly /etc/aide.conf; confirm the database directory and any cron or systemd schedule supplied by the installed package |
Debian-family installation can ask whether to initialize the database. Read the prompt and still verify the resulting paths and contents. Packaging details change between releases, so do not copy a path from an older guide without checking the files installed on this VPS.
After installation, record the installed version:
aide --versionRun that command as an ordinary user if possible; use sudo for operations that read protected files or write the database. Ensure the administrator account performing setup can read the installed configuration and has enough free space for the database and reports.
Read and validate aide.conf before creating the baseline
The configuration is case-sensitive and contains parameter lines, path-selection rules, exclusions and macros. The two settings that control the database lifecycle are:
database_in: the database that checks read.database_out: the location where initialization or an update writes a new database.
On Debian and Ubuntu, the main file is normally /etc/aide/aide.conf; some package versions assemble additional snippets from /etc/aide/aide.conf.d through an update helper. On RHEL 9, the main file is commonly /etc/aide.conf. Use the file actually referenced by the installed command and inspect included snippets as well.
Review the existing rules
Look for the path rules that cover /etc, binaries, SSH, service units, scheduled tasks and application directories. Ubuntu’s current examples use named attribute groups such as OwnerMode, StaticFile and Full, together with exclusion rules. Those names and defaults are not guaranteed to be identical on another distribution or release.
If you need to add a path, use the attribute groups already defined in your installed configuration instead of inventing a rule from a different release. A common shape is:
# Illustrative only: use groups defined in this installation
/etc Full
!/etc/volatile-pathThe exact group definitions and exclusion syntax must match your version. In particular, check whether an existing rule already includes a path before adding a second, conflicting rule. Keep application deployment directories narrow enough that routine uploads do not overwhelm the report, while including the code and configuration whose unauthorized modification would matter.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Read the rules from top to bottom and pay attention to exclusions that override a broader parent path. A rule that appears to cover /etc may still omit a subtree through a later exclusion. Conversely, adding a broad rule can bring in sockets, caches or generated state that changes between every scan. Treat the installed file as the authority for syntax and macro definitions.
Check the configuration
Where the installed version supports it, validate the configuration before initialization:
sudo aide --config-checkFix every parse error before proceeding. A typo in a parameter or a path rule can produce a baseline that omits files you thought were protected.
Initialize and activate the AIDE database
1. Generate a database
sudo aide --initAIDE writes the new database to database_out. Package defaults commonly create a file named aide.db.new, but the extension, compression and directory can differ. Read the command output and the active configuration rather than assuming a particular filename.
2. Review the generated file and scope
Confirm that initialization completed without errors and that the output path is on the filesystem you intended. If the command reports inaccessible files, missing directories or rule errors, correct the configuration and regenerate instead of accepting an incomplete baseline. Check that the monitored paths represent the final service layout, not an interim staging tree.
3. Move the database to database_in
The generated file is not automatically the active baseline. Move or rename it to the exact location configured by database_in. For a common Debian-family layout, the operation looks like this:
sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.dbUse the paths printed by your installed configuration; the directory and filename can differ, particularly on RHEL-family systems or when compression is enabled. Protect the database and its parent directory from unauthorized writes. An attacker who can silently replace both the configuration and the baseline can undermine local integrity checking.
Keep the move as a deliberate activation step. Before it, verify that the file was generated after the final approved maintenance and that the destination is writable only by the intended administrator or system account. If you retain an earlier baseline, label it with its creation date and change record rather than overwriting it without trace.
Rank #3
4. Run the first comparison
sudo aide --checkThe first check should compare the live VPS with the baseline you just activated. The Ubuntu AIDE manual explicitly requires initialization and moving the database to the appropriate database_in location before --check can be used.
Understand and investigate check results
A report is a change list, not an automatic verdict that the server is compromised. For each reported path, establish what changed, who authorized it, when it changed and whether the new state is correct.
- Expected package maintenance: updates commonly replace binaries, libraries, documentation and configuration files.
- Expected administration: editing SSH policy, adding a service unit or deploying application code changes monitored files.
- Unexpected changes: unexplained modifications to privileged binaries, SSH host keys, authentication configuration, scheduled tasks or deployment code warrant immediate investigation.
- Noise: repeatedly changing logs, caches or runtime files indicate that the scope or attribute selection needs refinement.
Read the complete report and the command’s exit status. Distribution wrappers and schedulers may interpret nonzero results differently, so consult the installed manual and job script before building alerting logic around a particular numeric code.
Correlate a difference with package-manager history, deployment records, administrator activity and service logs. A timestamp alone does not identify the person or process responsible. If a change cannot be explained, preserve the report and the current system state before making further modifications.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Update the baseline after approved changes
Do not overwrite the baseline merely because a report is inconvenient. First finish the maintenance, verify that every difference is authorized, and preserve the report or change record. Then generate a replacement database:
sudo aide --update--update writes a new database; it does not safely replace the old input database in place. Review the generated output, then move it to the path configured by database_in using the workflow documented for your package. Keep a protected copy of the previous baseline when your operational or incident-response plan requires historical comparison.
If a change is not authorized, do not run --update to make it disappear. Isolate and investigate the VPS according to your security procedure, and use a trusted backup or rebuild process when appropriate. Updating after an unexplained change converts an alert into the new definition of normal and can destroy useful evidence.
Run AIDE automatically every day
Inspect what the package installed
Ubuntu and Debian packages commonly provide a daily job at /etc/cron.daily/aide. Ubuntu documentation also describes report mail controlled by MAILTO in /etc/default/aide. Check both files on the installed release:
ls -l /etc/cron.daily/aide
sudo sed -n '1,200p' /etc/default/aideOther distributions may provide a systemd timer, a cron entry elsewhere, or no schedule at all. Search the installed units and cron configuration:
Rank #4
systemctl list-timers --all | grep -i aide
sudo grep -R "aide" /etc/cron* /etc/systemd/system /usr/lib/systemd/system 2>/dev/nullDo not assume that installing the package enabled the job. Confirm whether the scheduler is present, enabled and actually executing under the expected privilege. Packaging and unit names can change across distribution releases.
Make delivery observable
A schedule that runs silently, fails to start, or writes to an unread local mailbox is not an effective detection workflow. Configure the supported job to send output to a mailbox or logging destination that an administrator monitors. Verify that the intended account has permission to read the database and protected paths, and that the scheduler runs with the required privileges.
Mail delivery depends on the VPS having a functioning local mail-transfer and forwarding setup. If MAILTO points to a local account nobody checks, the job may appear healthy while alerts are ignored. A centralized logging destination or monitored mailbox is preferable when local delivery is unreliable. Document who owns the report queue and how an urgent difference is escalated.
Perform an authorized end-to-end test
During a documented maintenance window, make one reversible change to a monitored file, run the scheduled command or its underlying AIDE command, and confirm that the report reaches its destination. Revert the change and run the check again. Do this only on a VPS where you are authorized to alter the file; do not claim a test succeeded until you have observed the actual report and exit behavior.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common installation and operation problems
--check says that no database exists
Inspect database_in, confirm that the file exists at that exact path, and compare it with the path printed by aide --init. Move the generated .new database into place only after confirming that it was created from the intended clean state.
Initialization or configuration validation fails
Read the first parse or permission error, check capitalization and included files, and verify that every configured directory exists. Distribution snippets can change between releases; use the syntax and macros shipped with this installation.
The report is extremely large
Identify which paths change routinely, then decide whether those changes are security-relevant. Add narrowly scoped exclusions or less noisy attribute groups only after reviewing the implications. Do not exclude an entire parent directory merely to hide one noisy subdirectory if the parent contains security-critical files.
The daily job produces no message
Run the job manually as the scheduler’s privilege level, inspect its standard error and system logs, and check the configured MAILTO or systemd journal destination. Local mail requires a functioning mail-transfer and delivery setup; otherwise send output to a monitored external or centralized logging path approved for the VPS.
An update seems to erase evidence
Stop before moving the newly generated database. Preserve the old baseline and the change report, investigate unexplained differences, and replace the input database only after authorization. The update workflow should be part of change control, not an automatic response to every alert.
Best Value
The package prompt and documentation disagree
Trust the files installed on the VPS over a copied command from an older tutorial. Read the active configuration, inspect the package’s cron or systemd files, and use the paths shown in command output. Debian-family releases may assemble configuration snippets, while RHEL-family releases commonly use a single main file, so identical instructions are not guaranteed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Protect AIDE as part of the VPS security plan
- Restrict write access to
aide.conf, included snippets, the database directory and scheduled-job files. - Include the configuration and database in backups or an incident-response plan, while protecting those copies from the same account compromise.
- Record the AIDE version, configuration changes and baseline replacement dates.
- Review reports promptly; file-integrity monitoring has little value if alerts are never examined.
- Keep the monitored scope aligned with the services actually running on the VPS. Revisit it after installing a new web server, database, agent or deployment system.
AIDE detects that selected filesystem attributes differ from the baseline. It does not explain who made a change, prevent the change, inspect network traffic or restore a compromised server. Pair its reports with operating-system logs, access controls, backups and a response procedure.
Installation and verification checklist
aide --versionreturns the installed version.- The active configuration file and any included snippets have been reviewed.
database_inanddatabase_outpoint to intentional, protected locations.- The monitored paths include the VPS’s security-critical configuration, SSH files, privileged binaries, service units, scheduled tasks and application deployment directories.
- Volatile paths are excluded or assigned appropriate rules.
sudo aide --config-checksucceeds where supported.sudo aide --initcompleted on a known-clean system.- The generated database was moved to the configured
database_inpath. sudo aide --checkcompletes, and its report and exit status are understood.- Authorized changes use
sudo aide --updatefollowed by review and controlled activation of the replacement database. - A cron job or systemd timer runs with the intended privilege and delivers readable reports.
- Database files and configuration are protected and covered by backup or incident-response procedures.
- A deliberate, documented test change is detected and reverted during an authorized maintenance window.
Frequently Asked Questions
Can I run aide --check immediately after installation?
No. Initialize a database first with sudo aide --init, then move the generated file to the exact database_in path. Only then can sudo aide --check compare the VPS with a baseline.
Where does aide.db.new go?
It is commonly written under /var/lib/aide on Debian-family systems, but the directory and filename depend on the installed configuration. Read database_out and move the generated file to the location named by database_in.
How do I monitor SSH files and /etc?
Review the rules already supplied in your installed aide.conf. Ensure /etc, /etc/ssh, host keys, authentication settings and other security-critical files are covered, while excluding only volatile subdirectories that are not useful to monitor.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Should I run aide --update after every alert?
No. Investigate every difference first. Use --update only after an authorized package, configuration or deployment change has been verified, and preserve the old baseline and report when historical evidence matters.
How can I run AIDE every day?
Debian and Ubuntu commonly install /etc/cron.daily/aide, with report mail controlled by MAILTO in /etc/default/aide. RHEL 9 systems may use a different cron or systemd arrangement. Inspect the installed files, confirm the job is enabled, and test that reports reach a monitored destination.
What if the AIDE report is full of harmless changes?
Identify the paths and attributes causing the noise. Refine the scope with narrowly targeted exclusions or a less noisy attribute group, but do not remove a whole parent directory when it contains security-critical files. Revalidate the configuration and create a new baseline only after the rules are correct.
The Bottom Line
Install the package for your distribution, inspect and validate its actual configuration, initialize AIDE after the VPS reaches a known-clean state, and move the generated database to database_in. Treat every report as a change to investigate, update the baseline only after approved maintenance, and verify that a daily cron or systemd job delivers reports to someone who will act on them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
