[Aide] WARNING: Old db contains a entry that shouldn't be there, run --init or --update

[Hannes von Haugwitz]

Hi,

On Sat, May 02, 2020 at 09:06:33AM -0400, vince at vheuser.com wrote:
> On 2020/02/25 15:23 PM, Hannes von Haugwitz wrote:
> > On Mon, Feb 24, 2020 at 08:32:28PM -0500, vince at vheuser.com wrote:
> > > I've search several times and read dozens of posts
> > > from people asking newbies to post their config.
> > > 
> > > What I have not found is the means of troubleshooting this problem.
> > > How does one find the "entry that shouldn't be there?"
> > > 
> > > Here's the most detailed discussion I found:
> > > https://alioth-lists-archive.debian.net/pipermail/pkg-aide-maintainers/2014-September/002196.html
> > > 
> > > There seem to be no posts out there describing what to check.
> > > Is this a bug or how does on find the problem?
> > The message basically means that there are entries in the database with
> > no matching rule in the configuration file(s). A reinitialization of the
> > database logically would help here, as the entries wouldn't be re-added
> > due to the missing matching rule.
> > 
> > Currently I'm rewriting the report and logging code of AIDE and I plan
> > to also improve the handling of the above situation.
> 
> Thanks, Hannes.
> Despite having reinitialized the database many times now, I still get this error.
> I have a set of scripts that create the rules based on the current state of
> things on the server.
> Obviously, one of the scripts is inserting something incorrectly.
> How do I find the specific rule that is causing the problem?

Does one of your scripts "remove" rules from your config?

To ease debugging I rephrased the warning a bit in eb86e78[0]. It now
names the first entry of the old databse that causes the warning.

Best regards

Hannes

[0] https://github.com/aide/aide/commit/eb86e787b17def1b54a5d8cd501372b26c2eb5fe