Vigil Baseline

At a glance

• Editor score
  7.7 / 10
• Pricing
  Free plan
• Best for
  Linux users wanting lightweight real-time FIM
• Free plan
  Yes
• Paid from
  Free
• Real-time alerts
  Yes
• Facts checked
  21 Sep 2026

• Where it wins

  • Kernel-level real-time watching with an inotify fallback
  • Tracks hashes, permissions, ownership, inode data, and security contexts
  • HMAC-chained audit trails with crash-safe write-ahead logging

• Where it doesn't

  • Limited to Linux desktop distributions
  • Designed for one workstation and one human operator
  • No fleet, server, container, or centralized reporting support

Our verdict on Vigil Baseline

Vigil Baseline is a local file integrity monitor for a single desktop Linux workstation. It records a baseline of selected files, then compares filesystem events against that baseline as changes occur. The project is aimed at one human operator who wants on-premises monitoring without a hosted service. It supports Linux desktop distributions including Arch, Debian, Ubuntu, and Fedora, and is free and open source. The dual-licensed project is available under GPLv3-only or commercial licensing.

Its strongest capability is the depth of its local change records. Vigil Baseline uses BLAKE3 file hashing and kernel-level filesystem watching through fanotify, with an inotify fallback. Monitoring covers permissions, ownership, inode data, capabilities, extended attributes, and security contexts rather than relying on file contents alone. Detected deviations are written to a crash-safe write-ahead log and an HMAC-chained audit trail. Optional desktop notifications through notify-send provide a local alert path, while webhook and signal-socket integration points support connections to other workflows.

The product’s scope is deliberately narrow. It fits a Linux desktop that needs real-time detection and detailed, tamper-evident local records, but it is not intended for servers, headless hosts, fleets, containers, or centralized reporting. Buyers needing multi-system administration, centralized visibility, or broader platform coverage should choose a product designed for those environments instead. Vigil Baseline is the better fit for an individual Linux workstation operator who values open-source, local monitoring and detailed filesystem metadata without requiring an expanded management layer.

Your product? Our editors can test Vigil Baseline in depth and publish a review, labelled as paid · from $149/mo →

Vigil Baseline pricing

Vigil Baseline fact sheet

Vigil Baseline integrations

Vigil Baseline lists 2 integrations on its own site.

• Webhook
• Signal socket

Alternatives to Vigil Baseline

• CimTrak Integrity SuiteA broad hybrid integrity suite for organizations managing compliance and infrastructure change.9.4
• Tanium Integrity MonitorEnterprise monitoring with detailed endpoint context, watchlists, and investigation workflows.8.8
• AOAtomic OSSECBroad security coverage with real-time FIM, starting at $5 per server monthly.8.5

See all Vigil Baseline alternatives →

Featured on iTechGuides

Vigil Baseline is listed in our File Integrity Monitoring Software directory. Add the badge to your site — it links back to this page.

<a href="https://www.itechguides.com/products/vigil-baseline/"><img src="https://www.itechguides.com/best/badge/vigil-baseline.svg" alt="Featured on iTechGuides" width="230" height="46"></a>

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated 7 Oct 2026 · How we research and update