[Aide] Tracking only changes on existing files

Hannes von Haugwitz hannes at vonhaugwitz.com
Thu May 4 19:36:44 EEST 2017


Hi Philippe,

On Thu, May 04, 2017 at 10:26:00AM +0200, Maupertuis Philippe wrote:
> A directory is used for archiving files. A new subdirectory is created
> each day with files added to this new subdirectory.  At the same time
> one year old archives and the corresponding directory is deleted.  No
> file change should  occur once the file is created but I would like to
> have no alerts for added (today) files and possibly for deleted one
> year old files.  Is that possible with aide without fiddling with the
> configuration file every day ?

You can use the ANF and ARF attributes for these files.

Excerpt from the aide.conf(5) man page:

    When 'ANF' is used, new files are added to the new database, but
    are ignored in the report.

    When 'ARF' is used, files missing on disk are omitted from
    the new database, but are ignored in the report.

Best regards

Hannes


More information about the Aide mailing list