[Aide] Can't read database file

[Richard van den Berg]

Hello Jesse,

On Tue, June 30, 2009 18:41, Jesse wrote:
> When I run sudo strace /usr/sbin/aide -i -c aide_web.conf, this is what
> the tail end of my output looks like:
>
>
> getxattr("/afs/uncc.edu/coe/coe-web/seem/login/index.php",
> "system.posix_acl_access", 0xbf903010, 132) = -1 EOPNOTSUPP (Operation not
> supported)

This looks like you are trying to use the xattrs rule on a file system
that does not support it. Remove xattrs from any rules you have defined in
your aide.conf.

> It seems to work because it tells me that the AIDE database is initialized
> in /tmp/aide.db.new.
> When I run sudo strace /usr/sbin/aide -c aide_web.conf however, I find
> this
> output:
[snip]
> open("/tmp/aide.db", O_RDONLY|O_LARGEFILE) = -1 ENOENT (No such file or
> directory)

You need to rename /tmp/aide.db.new to /tmp/aide.db after inspecting it.
Aide will never create a new aide.db by itself. This is a manual task for
the administrator.

Regards,

Richard