AIDE Reports: Showing

Overview: Understanding the process

This guide provides ome information about commands that are recommended. However, it is good to understand what these commands do. They are basically a fancy way of using tail to show a desired amount of lines, discarding less interesting things from the beginning of some log files. If you don't have these instructions handy, and cannot run the aiderpvw script (because of software incompatibility, or perhaps the script simply isn't installed), you can manually locate the information at the end of the log files that were created.

This guide uses a process to update the database, and that specific process creates log files in the /var/log/aide/ directory. (This is somewhat of a custom approach; I believe there is no /var/log/aide/ directory in a default AIDE installation.)

Using a script

Rotating has been a process that gets repeated enough that using a script file was deemed worthwhile. See if the script file exists:

which aiderpvw

If the script exists

If it does, then, great. Go ahead and use it (if you trust the software on this machine).

echo ${PAGER} aiderpvw | ${PAGER}

Otherwise

If the script doesn't exist yet, determine whether it should be installed. The key reason not to use the script is just that the current version requires OpenSSH's ksh (or a suitably compatible shell; bash is also currently believed to be suitable enough to work). If such a shell is undesirable, then using the older method may be needed.

If you are going to be using the script, start by obtaining, and then installing it as follows:

export AIDEWSCF=http://cyberpillar.com/dirsver/1/mainsite/techns/bhndscen/protsoft/filintgr/aide/mkaidecf/aidecfsc/aidecfs1

A private server can be specified instead of the public URL shown above.

ftp -v -o ~/aiderpvw.gz ${AIDEWSCF}/aidescr1/aiderpv1.gz ln ~/aiderpvw.gz ~/gztoextr.gz gzip -d ~/gztoextr.gz sudo mv -i ~/gztoextr /usr/local/bin/aiderpvw sudo chown :wheel /usr/local/bin/aiderpvw sudo chmod ug+x /usr/local/bin/aiderpvw

Check the ${PAGER} value.

echo ${PAGER}

aiderpvw

The older approach

See: AIDE Report Viewing.