How to Set Up File Integrity Monitoring on Linux Using Aide with Automated Checks and Alerting on Ubuntu

Learning how to set up file integrity monitoring on Linux using AIDE with automated checks and alerting on Ubuntu is one of the smartest security decisions you can make for your server. File integrity monitoring (FIM) detects unauthorized changes to critical system files. It alerts you when something unexpected happens. This is essential for catching intrusions, malware, and accidental misconfigurations before they cause real damage.

AIDE stands for Advanced Intrusion Detection Environment. It creates a database snapshot of your filesystem. Then it compares future states against that snapshot. Any differences trigger an alert. In this tutorial, you’ll install AIDE on Ubuntu, initialize the database, automate daily scans with cron, and configure email alerts so you’re notified immediately when changes occur. By the end, you’ll have a fully working FIM system running quietly in the background, protecting your server around the clock.

Prerequisites for Setting Up File Integrity Monitoring on Linux

Before you start, make sure you have the following in place:

– A server running Ubuntu 20.04 or 22.04 LTS
– Root or sudo access to the server
– A working mail transfer agent (MTA) like Postfix for email alerts
– Basic familiarity with the Linux command line
– An active internet connection for package installation

You should be comfortable editing configuration files with a text editor like nano or vim. You don’t need advanced Linux knowledge, but you should understand basic commands like cd, cat, and chmod.

Estimated time to complete this tutorial is around 30 to 45 minutes. Most of that time is waiting for AIDE to initialize its database, which scans your entire filesystem. On a busy server with many files, this can take 10 to 20 minutes.

You can read more about AIDE’s capabilities in the official AIDE documentation.

How to Set Up File Integrity Monitoring on Linux Using AIDE

Related tutorial: How to Install and Configure Fail2ban on Ubuntu Server for Ssh Protection

Follow these steps carefully. Each step builds on the previous one.

Step 1: Update your system packages

Always start with a fresh package list. This prevents installation errors.

sudo apt update && sudo apt upgrade -y

Step 2: Install AIDE

AIDE is available in the default Ubuntu repositories. Install it with a single command.

sudo apt install aide aide-common -y

During installation, Ubuntu may prompt you about configuration options. Accept the defaults for now.

Step 3: Review and customize the AIDE configuration

The main configuration file lives at /etc/aide/aide.conf. Open it with your editor.

sudo nano /etc/aide/aide.conf

This file defines which directories AIDE monitors and what attributes it checks. By default, AIDE watches critical paths like /bin, /sbin, /etc, and /usr. You can add custom directories. For example, to monitor your web root, add this line:

/var/www/html CONTENT+EXT

The CONTENT+EXT rule checks file contents, permissions, and extended attributes. Save and close the file when done.

Step 4: Initialize the AIDE database

This step scans your filesystem and creates the baseline database. It takes time, so be patient.

sudo aideinit

AIDE writes the new database to /var/lib/aide/aide.db.new. You need to copy it to the active location.

sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Never skip this copy step. AIDE won’t run checks without the active database file.

Step 5: Run a manual check to verify everything works

Before automating anything, confirm that AIDE runs correctly.

sudo aide --check

If your system is clean and unchanged since initialization, AIDE should report no differences. If you see changes, that’s normal if you made edits between steps 3 and 4. Re-initialize the database after any intentional changes.

Step 6: Install and configure Postfix for email alerts

You need a working mail system to receive alerts. Install Postfix if you haven’t already.

sudo apt install postfix mailutils -y

Choose “Internet Site” during the Postfix setup wizard. Enter your server’s fully qualified domain name when prompted. Test that mail works with this command, replacing the address with your own.

echo "Test email from AIDE server" | mail -s "AIDE Test" [email protected]

Check your inbox. If the email arrives, your mail setup is working.

Step 7: Create an automated check script with alerting

Create a shell script that runs AIDE and emails you the results.

sudo nano /usr/local/bin/aide-check.sh

Paste the following content into the file. Replace [email protected] with your actual email address.

#!/bin/bash
REPORT=$(aide --check 2>&1)
if echo "$REPORT" | grep -q "changed|added|removed"; then
  echo "$REPORT" | mail -s "AIDE Alert: File Changes Detected on $(hostname)" [email protected]
fi

Save and close the file. Make it executable.

sudo chmod +x /usr/local/bin/aide-check.sh

This script only sends an email when AIDE actually detects changes. You won’t get spammed with empty reports every day.

Step 8: Schedule the script with cron

Open the root crontab to add a daily scheduled task.

sudo crontab -e

Add this line to run the check every day at 3:00 AM.

0 3    /usr/local/bin/aide-check.sh

Save and exit. Cron will now run your integrity check automatically every night. You’ll only receive an email if something changes on your server.

For more details on scheduling tasks, check the Ubuntu Server documentation.

Troubleshooting Common AIDE Issues on Ubuntu

AIDE reports too many false positives

Log files and temporary files change constantly. Exclude them from monitoring to reduce noise. Add exclusion lines to /etc/aide/aide.conf.

!/var/log
!/tmp
!/proc

The ! prefix tells AIDE to ignore that path entirely. After editing the config, always reinitialize the database.

The aide –check command fails with a database error

This usually means the active database file doesn’t exist. Check with this command.

ls -la /var/lib/aide/

If you only see aide.db.new, you forgot the copy step. Run it now.

sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Email alerts aren’t arriving

Check your Postfix status first.

sudo systemctl status postfix

Also check the mail log for errors.

sudo tail -f /var/log/mail.log

Some cloud providers block outbound port 25. You may need to configure Postfix to relay through an SMTP service like SendGrid or Amazon SES.

AIDE initialization takes too long

This is normal on servers with large filesystems. You can limit the scope of monitoring in aide.conf to only the most critical directories. This speeds up both initialization and daily checks significantly.

Conclusion: Keeping Your Server Secure with File Integrity Monitoring

You now know how to set up file integrity monitoring on Linux using AIDE with automated checks and alerting on Ubuntu. Your server now has a reliable early warning system. AIDE will scan your filesystem every night and email you immediately if anything changes unexpectedly.

This setup gives you real visibility into what’s happening on your server. It’s especially useful after software updates, when you want to confirm that only expected files changed. It also catches attackers who modify system binaries or drop new files after gaining access.

From here, consider storing your AIDE database on a separate read-only volume. This prevents attackers from tampering with the baseline. You might also explore integrating AIDE reports with a centralized logging platform like the Elastic Stack for long-term trend analysis and dashboards.