0

I have installed aide on Ubuntu 22.04 and left the default configuration. After it ran, I got an email report that indicates that everything went smooth. See the report below.
The /var/lib/aide/aide.db.new and /var/lib/aide/aide.db are zero bytes. There's plenty free space on the device and I can't find anything unusual in the log files.

Any ideas how to search for the cause of that issue?

AIDE returned with exit code 1. Added entries detected!


AIDE produced no errors.

******************************************************************************
*    AIDE has returned long output which has been truncated in this mail     *
******************************************************************************
Output is 2792556 lines, truncated to 1000.
Start timestamp: 2023-08-20 06:25:01 +0200 (AIDE 0.17.4)
AIDE found differences between database and filesystem!!
New AIDE database written to /var/lib/aide/aide.db.new
Ignored e2fs attributes: EIh

Summary:
  Total number of entries:      2792523
  Added entries:                2792500
  Removed entries:              0
  Changed entries:              0
Christopher
  • 3
  • 1
  • You haven't specified how did you run `aide`. The default action is just a check, without updating the db. – AlexD Aug 21 '23 at 12:16
  • Thanks for pointing out. The packaged version adds a script in `/etc/cron.daily/`. I have the packaged version on several servers and all others work like expected (i.e. writes the aide.db.new). – Christopher Aug 21 '23 at 14:02

1 Answers1

0

On Ubuntu, you need to run aideinit to create the new database after installing aide package.

AlexD
  • 8,747
  • 2
  • 29
  • 38
  • Thanks Alex. I ran `aideinit` but after that, I fired a maintenance script, that copies aide.db.new over aide.db -- while aide was running. That more or less destroys the database and makes it necessary to run `aideinit` again. – Christopher Aug 25 '23 at 10:41