[Aide] AIDE configuration taking too long

Hi my organization is not satisfied with the deafult aide configuration. We want to look at all the files in the root file system without excluding directories for security reasons. We know that certain directories will only be checked for certain attributes for example log files would not have

Re: [Aide] AIDE configuration taking too long

: On 28 Aug 2013, at 8:53 PM, Mason Nakadomari nakad...@hawaii.edu wrote: Hi my organization is not satisfied with the deafult aide configuration. We want to look at all the files in the root file system without excluding directories for security reasons. We know that certain directories

Re: [Aide] AIDE configuration taking too long

with very basic parameters like u+p+i? On Aug 28, 2013 3:48 PM, Keith Constable kccric...@gmail.com wrote: On 28 Aug 2013, at 9:37 PM, Mason Nakadomari nakad...@hawaii.edu wrote: Thank you for the response. I am running aide.init. Yeah we thought it was strange given its only 50 gigs in root

Re: [Aide] AIDE configuration taking too long

, Marc Haber mh+a...@zugschlus.de wrote: On Wed, Aug 28, 2013 at 02:53:01PM -1000, Mason Nakadomari wrote: We figured that the removal of a checksum would help performance No. aide is almost always disk-bound, computing the checksum happens in negligible time on today's system. You're waiting

Re: [Aide] AIDE configuration taking too long

Meaning I will see if my scans go faster without those directories but I'd still like to scan those directories in a way to make it faster. It shouldn't be impossible to scan those directories should it? On Aug 29, 2013 8:08 AM, Mason Nakadomari nakad...@hawaii.edu wrote: Hi we are using fibre

Re: [Aide] AIDE configuration taking too long

+a...@zugschlus.de wrote: On Thu, Aug 29, 2013 at 08:09:34AM -1000, Mason Nakadomari wrote: Meaning I will see if my scans go faster without those directories but I'd still like to scan those directories in a way to make it faster. It shouldn't be impossible to scan those directories should

Re: [Aide] AIDE configuration taking too long

I'm enacting some of your advice immediately thank you very much to the both of you. I'll let you know my progress. I know I'm a rookie at this but I appreciate the help. On Thu, Aug 29, 2013 at 8:49 AM, Marc Haber mh+a...@zugschlus.de wrote: On Thu, Aug 29, 2013 at 08:09:34AM -1000, Mason

Re: [Aide] AIDE configuration taking too long

-1000 Mason Nakadomari nakad...@hawaii.edu wrote: I've removed /proc /dev /sys from my scans and even cutdown on /var/spool and /var/log. However my scans are still taking more than 24 hours to complete. Any other recommended configs. The aide manual gave hints but nothing definite. Still

Re: [Aide] AIDE configuration taking too long

Thank you very much I excluded the appropriate directories and I have gottent he time down considerably and actually completed a scan. Thanks very much for the help. On Mon, Sep 2, 2013 at 10:14 AM, Mason Nakadomari nakad...@hawaii.eduwrote: Thanks. I am running a verbose scan. I'm gonna check

Re: [Aide] prelinking issue

in aide configuration file. I looked in the manual and couldn't find any thanks. On Sep 4, 2013 3:37 PM, Mason Nakadomari nakad...@hawaii.edu wrote: Hi ___ Aide mailing list Aide@cs.tut.fi https://mailman.cs.tut.fi/mailman/listinfo/aide

[Aide] rules questions

I've looking over the manual and I wanted to check if my understanding s correct. my understanding is that if I want to search individual directories with a less general rule like CUSTOMTEST6 but still scan everything else using a general rule like CUSTOMTEST1 that I would use something like the

Re: [Aide] rules questions

Hi any help or confirmation would be appreciated. Thank you for your time thanks. On Sep 5, 2013 11:15 AM, Mason Nakadomari nakad...@hawaii.edu wrote: I've looking over the manual and I wanted to check if my understanding s correct. my understanding is that if I want to search individual

Re: [Aide] rules questions

. On Sep 6, 2013 6:36 AM, Mason Nakadomari nakad...@hawaii.edu wrote: Hi any help or confirmation would be appreciated. Thank you for your time thanks. On Sep 5, 2013 11:15 AM, Mason Nakadomari nakad...@hawaii.edu wrote: I've looking over the manual and I wanted to check if my understanding s

Re: [Aide] rules questions

misunderstanding the documentation on this? Please advise. On Sep 6, 2013 6:36 AM, Mason Nakadomari nakad...@hawaii.edu wrote: Hi any help or confirmation would be appreciated. Thank you for your time thanks. On Sep 5, 2013 11:15 AM, Mason Nakadomari nakad...@hawaii.edu wrote: I've looking over the manual

Re: [Aide] AIDE configuration taking too long

tips would be appreciated I'm sorry I just have no idea why its taking so long. The file system is about 50 GB but at best we are scanning 20 GB. Thanks any advice is appreciate. I'm sorry for the trouble. On Wed, Sep 4, 2013 at 3:36 PM, Mason Nakadomari nakad...@hawaii.eduwrote: Thank you very

[Aide] Config file on aide check

Hi I wanted to clear up my confusion about how aide works. Does the aide --check command work if there is no aide.conf. when a check is run then it won't run right? Also I just wanted to check that the aide check doesn't update the conf every time a check happens. I believe that it only updates

Re: [Aide] AIDE configuration taking too long

5.2128.5041.67 12.42 0.034.75 0.75 0.42 dm-1 0.00 0.000.000.00 0.00 0.00 8.00 0.005.78 0.87 0.00 On Sun, Sep 8, 2013 at 2:19 AM, Mason Nakadomari nakad...@hawaii.eduwrote: Thank you for the response Richard. I just was beginning

Re: [Aide] Config file on aide check

Thanks Richard do you reommend always running AIDE in init mode to update changes to the conf file or is AIDE in update mode sufficient thanks. On Sun, Sep 8, 2013 at 3:44 AM, Richard van den Berg rich...@vdberg.orgwrote: On 8-9-13 14:22 , Mason Nakadomari wrote: Okay thanks. When you run

[Aide] include file ability in AIDE

I was wondering if it was possible for AIDE to parse and recognize an include file option in the aide.conf. I haven't been able to find one. My boss thinks that it would be useful if you could add include files to the aide.conf file. ___ Aide mailing

Re: [Aide] include file ability in AIDE

Thanks that seems very useful I'll start testing it right away. Thanks. On Thu, Sep 12, 2013 at 7:45 AM, Hannes von Haugwitz han...@vonhaugwitz.com wrote: Hi, On Wed, Sep 11, 2013 at 04:31:30PM -1000, Mason Nakadomari wrote: I was wondering if it was possible for AIDE to parse

[Aide] Is there anyway to tell AIDE to automatically accept changes to a database on a check or update

Hi we wanted to know if it was possible to tell the config file or the aide command to update any changes to a particular path or directory. For example we use puppet to update our password files. While we could use aide.init to accept all changes in mass to all of our servers we would be ignoring

Re: [Aide] Is there anyway to tell AIDE to automatically accept changes to a database on a check or update

Hi any ideas on this. I know this may be more of a feature request but i wanted to make sure there wasn't a way to do this in AIDE. Thanks let me know. On Thu, Sep 12, 2013 at 9:48 AM, Mason Nakadomari nakad...@hawaii.eduwrote: Hi we wanted to know if it was possible to tell the config file

[Aide] Does aide update have an interactive mode

Hi does aide update have an interactive mode like how tripwire does in update mode. We wanted to be able to select the changes to accept or be prompted. I can't find anything that shows aide --update having an interactive mode. Thanks. ___ Aide mailing