Marc Haber <[EMAIL PROTECTED]> wrote: > I have instead committed the following patch to the README file which > will hopefully make things a lot more clearer than they were explained > in the previous README file. I'd appreciate your comments.
Excellent! > + - set COMMAND="update" and COPYNEWDB="yes" and live with the fact > + that changes to the filesystem will only be reported once and never > + again. I found that setting COPYNEWDB to yes suits me well. I also found that because this setting trashes the old database, you don't have a chance to later run aide --compare to see how a particular file changed. I therefore added AIDEARGS="-V5" to /etc/default/aide. Because you're updating the database every day, the emails still tend to be small, and even if they are large and get truncated (due to a system update, say), you still have the output in /var/log/aide. I think it would be good to mention that issue in the COMMAND="update" and COPYNEWDB="yes" item. -- Bill Wohler <[EMAIL PROTECTED]> http://www.newt.com/wohler/ GnuPG ID:610BD9AD -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
