iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Install AIDE from your VPS distribution’s package manager, review its configuration, initialize a baseline on a known-clean system, and activate the generated database at the path configured by database_in. Only then can sudo aide --check compare the live filesystem with that baseline. A recurring scan is useful only if you investigate its reports and deliver them somewhere an administrator reads.
What AIDE does—and what it does not do
AIDE is a file-integrity checker. It builds a database describing configured paths on your server, then compares later scans with that baseline and reports differences. For a VPS, this can help you notice unexpected changes to important files, such as SSH configuration, service definitions, privileged binaries, or application deployments.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
AIDE is not a substitute for backups, access controls, patching, or incident response. Its findings depend on the paths and attributes selected in the configuration, whether the baseline is trustworthy, and whether reports are reviewed. A baseline created after an unauthorized change may simply record the compromised state as normal. Protecting the database and configuration matters too: someone able to alter both the files being checked and the baseline may undermine the comparison.
The setup has four connected parts: the installed package and its configuration; a baseline generated from the filesystem; activation of that database at the configured input location; and a reliable schedule and reporting destination. Skipping the activation step is a common reason the first check fails.
Install AIDE for your Linux distribution
Debian or Ubuntu
Refresh the package index and install AIDE:
sudo apt update
sudo apt install aideThe package installation may prompt you about database initialization. Read the prompt and note what it does rather than assuming the baseline is ready for use. Debian-family packaging commonly uses /etc/aide/aide.conf for configuration, /etc/default/aide for package settings, /var/lib/aide for database files, and /etc/cron.daily/aide for a daily job. These are common locations, not guarantees for every release or local setup; check the files actually installed on your VPS.
RHEL 9 and compatible distributions
Install through DNF:
sudo dnf install aideOn RHEL 9, the security guide identifies /etc/aide.conf as the configuration file and directs administrators to initialize the database. Confirm the database paths and any supplied schedule on your own server after installation; do not assume Debian-family file locations apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Confirm what the package installed
Check that the executable is available and record its version:
aide --versionThen inspect the configuration, package defaults, and any cron or systemd scheduling files that came with the package. Packaging details can change between distribution releases, and local administrators may have changed them. The installed configuration—not a path copied from a different operating system—is the authority for where AIDE reads and writes its database.
Review the configuration before creating a baseline
AIDE’s configuration controls both the scan’s scope and the database workflow. The file is case-sensitive and can contain parameters, path-selection rules, exclusions, and macros. On Debian-family packages, configuration may also incorporate snippets from /etc/aide/aide.conf.d using update-aide.conf. Read the active configuration and its included files before initializing anything.
Check the database paths
Find the database_in and database_out settings. database_in identifies the database AIDE reads for a check; database_out identifies where a newly created or updated database is written. The initial baseline will not be usable for checks until the generated output is moved or renamed to the input location specified by the active configuration.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsDo not treat a filename such as /var/lib/aide/aide.db as universal. Debian-family packages commonly use that directory, but the configuration installed for your VPS may specify something else. Use the actual values in the active configuration and the paths AIDE reports.
Choose paths appropriate to a VPS
Review the configured selection rules and decide what matters for your server’s role. Typical review targets include:
/etc, including SSH configuration and host keys.- Privileged binaries and other system files whose unexpected replacement would be consequential.
- Service unit files and scheduled-task directories.
- Web-server configuration, if the VPS runs a web service.
- Application deployment directories and configuration that should not change outside an authorized release.
These are candidates to review, not a universal list to paste into every configuration. A web server, database host, and minimal utility VPS have different important files. Conversely, runtime state, caches, and pseudo-filesystems are often volatile and may not belong in a useful integrity baseline. Check whether the distribution’s rules already exclude them before adding exclusions of your own.
Selection and attribute rules determine what a change report can reveal. The configuration language includes groups such as OwnerMode, StaticFile, and Full, as well as path exclusions. Their exact meaning and appropriate use should be checked against the examples for the installed distribution and release. Ubuntu’s examples are useful syntax references, but they do not establish that every distribution ships identical defaults. Avoid broadening rules or adding exclusions without understanding which files and attributes they affect.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Validate the configuration
If the installed AIDE version supports configuration checking, run it before building the baseline:
sudo aide --config-checkResolve parsing errors before proceeding. If that option is unavailable in the installed version, consult the documentation for that package and version rather than assuming the command is supported everywhere. A baseline generated with a misunderstood or invalid scope can be difficult to correct later because it becomes the reference for subsequent checks.
Initialize the database and activate it
Start from a known-clean server state
Choose a point at which the VPS is in a state you trust: the operating system and applications are installed, authorized updates and configuration changes are complete, and you have investigated anything unexpected. AIDE’s baseline describes the files present at initialization. It does not determine whether those files were already altered by an intruder.
Record the maintenance state that the baseline represents, including relevant package updates and deployments. This gives you context when later reports show differences. If the machine’s integrity is in doubt, do not make a new baseline and treat it as proof that the system is clean; investigate and restore trust first.
Recommended Free Tools
Generate the initial baseline
After checking the active configuration, initialize AIDE:
sudo aide --initAIDE writes a new database to the configured database_out location. Package defaults commonly give the generated file a name such as aide.db.new. Read the command’s output to confirm where it wrote the file; do not infer the location from the filename alone.
Move the generated file to the configured input path
Once you have confirmed the system is in a known-clean state and initialization succeeded, place the generated database at the path specified by database_in. For example, Ubuntu’s common Debian-family workflow uses:
sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.dbUse that command only if those are the paths in your installed configuration. If database_out or database_in points elsewhere, adapt the source and destination to those actual paths. Keep the database protected from unauthorized modification; preserve a separate protected copy of the previous baseline when replacing one if that fits your operational and incident-response procedures.
The order matters: initialization creates an output database, while checks read the input database. AIDE’s Ubuntu manual states, “You must initialize a database and move it to the appropriate place (see database_in config option) before you can use the –check command.” Running a check before activating the baseline therefore does not complete setup.
Run a check and interpret changes
With the baseline activated, run the first comparison:
sudo aide --checkReview the report rather than treating every difference as an intrusion. Authorized package updates, administrator edits, service changes, and application deployments can all change monitored files. For each reported change, identify the affected path and determine whether it corresponds to documented maintenance or an unexpected modification. A change that is expected should still be accounted for; an unexplained change deserves investigation.
Learn how the installed version communicates findings, including its exit status and how output is delivered by any scheduled job. A command that completes is not enough if reports are discarded or their meaning is unknown. Record how you distinguish routine approved changes from events that need escalation.
Test detection in a controlled window
As a verification step, an administrator can make a deliberate, documented change to a monitored test file, run a check, confirm that the report identifies it, and then revert the change. Choose a file and maintenance window that will not disrupt services, and ensure the test is authorized. Do not modify sensitive system files casually just to generate a report. This is a recommended verification procedure, not a claim that any particular test has been performed.
Update the baseline after approved maintenance
When a package upgrade, configuration change, or deployment is authorized, first verify that the resulting changes are expected. AIDE’s update operation generates a replacement database:
sudo aide --updateReview the changes and the generated database path before activating the replacement. --update writes a new database; it does not safely replace the old input database in place. Follow the workflow documented for the installed distribution to move the reviewed output to the database_in location. Keep the previous baseline protected when operationally appropriate so that an update does not erase useful context about what the earlier reference contained.
Do not update the baseline simply to silence a report that you have not explained. Doing so can redefine an unexpected alteration as the new expected state. A safer sequence is: identify the change, establish whether it was authorized, investigate unexplained items, and only then create and activate a replacement baseline for approved maintenance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Schedule recurring checks and deliver their reports
A one-time check does not provide ongoing monitoring. Inspect the files installed by the package to see whether it supplies a daily cron job, a systemd timer, or another mechanism. Debian-family packaging commonly provides /etc/cron.daily/aide; Ubuntu community documentation says that this job runs daily and mails output to the account configured by MAILTO in /etc/default/aide. Other distributions may use a timer or provide no schedule. Verify what is present and enabled on the VPS instead of creating a second job that duplicates an existing one.
Make sure the schedule runs with the intended privileges, uses the configuration and database you expect, and sends its output to a mailbox or logging destination that someone monitors. A daily job that writes to an unread local mailbox—or runs without delivering a report—does not create an effective review process. If you change the package’s scheduling or mail settings, verify those settings in the installed files and confirm that the resulting report reaches its intended destination.
Choose a workable review routine
Decide who owns the report, how often it is reviewed, and what happens when a difference cannot be tied to authorized work. For a small VPS, that may mean routing package-generated mail to a monitored mailbox and documenting a manual investigation path. A larger operation may route logs through its existing monitoring process. The key requirement is a real delivery and response path, not a particular scheduling technology.
Free tools Windows power users keep installed
One-click scans. No signup required.
Common setup problems and what to check
| Symptom | What it usually points to | What to check |
|---|---|---|
--check cannot find or read a database |
The baseline has not been initialized, or the generated output was not activated at the input path. | Compare database_in and database_out in the active configuration with the actual file locations. Initialize if needed, then move the output to the configured input path. |
The generated .db.new file is not where expected |
The active configuration may use a different output path, or the package may differ from the common Debian-family layout. | Read database_out and initialization output; do not assume /var/lib/aide. |
| Configuration checking reports an error | A case-sensitive parameter, selection rule, macro, or included snippet may be invalid for this installation. | Review the active configuration and included files, then verify syntax against the installed version’s documentation before initializing. |
| Reports contain many changes after maintenance | Authorized updates may have modified monitored files, or the rules may include paths with frequent legitimate changes. | Review each item against maintenance records and reconsider whether the configured scope and exclusions match the VPS role. Do not update the database before explaining unexpected differences. |
| No report arrives from a scheduled run | The package’s job may not be installed or enabled, or its mail/log destination may not be monitored or configured as expected. | Inspect the actual cron or systemd files and the report destination, then verify delivery and ownership of review. |
Protect the baseline and make the process recoverable
AIDE’s comparison is only as useful as the integrity of its reference and the administrator’s ability to review it. Restrict write access to the configuration and database files, and include them in the VPS backup or incident-response plan. A backup should preserve a trustworthy copy without making it easy for unauthorized users to alter the baseline along with the system files it is meant to check.
Document where the active configuration lives, which database is active, how it was initialized, how the scheduled check runs, and where reports go. That information reduces confusion after a rebuild, package migration, or personnel change. If you restore or replace a VPS, establish whether the restored database corresponds to the restored system before using it as a baseline; a mismatched reference can produce changes that reflect recovery rather than an attack.
Quick Recap
Final verification checklist
aide --versionidentifies an installed AIDE version.- The active configuration and included snippets have been reviewed; configuration parsing succeeds if the installed version supports
--config-check. database_inpoints to the activated baseline, and the baseline was created from a known-clean system state.sudo aide --checkruns against that baseline, and you understand where its report and exit status are presented.- A deliberate, documented test change is detected and reverted only during an authorized maintenance window.
- The recurring cron or systemd job is present or enabled as intended, runs with appropriate privileges, and delivers a readable report to a monitored destination.
- The configuration and database are protected against unauthorized changes and covered by the VPS backup or incident-response plan.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
