====== AIDE (Advanced Intrusion Detection Environment) ======

<code bash>
apt-get update && apt-get install aide
</code>

Change destination mail if not root
  
<code bash>
vi /etc/default/aide
MAILTO=

aideinit
</code>

Install new db as reference

<code bash>
cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db
</code>

Manual check

<code bash>
aide -c /etc/aide/aide.conf --check
</code>

Manual update
<code bash> 
aide -c /etc/aide/aide.conf --update
</code>

On files/conf changes :

<code bash> 
aideinit
cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db
aide -c /etc/aide/aide.conf --check
</code>

aide.conf defines change patterns, ex : 
Directories that change their contents during system operation
i
<code bash>
VarDir = OwnerMode+n+i+X
</code>

then you find exceptions in dir /etc/aide/aide.conf.d
warning : when error is present in configuration files, the parser not always point them...