Zuzia.app logo
Get started
Features
How It Works
Pricing
About
Faq
Sign up Log In
← All guides

File Integrity Monitoring on Linux: AIDE, Tripwire & find

Updated:

File Integrity Monitoring on Linux: AIDE, Tripwire & find

File integrity monitoring is essential for detecting unauthorized file changes, maintaining security compliance, and identifying security breaches. This comprehensive guide covers everything you need to know about monitoring file integrity for security audits.

For monitoring file changes, see Monitor File Permissions Changes. For related security topics, see Server Security Audit.

Why File Integrity Monitoring Matters

Unauthorized file changes can indicate security breaches, malware infections, or system compromises. File integrity monitoring helps detect these changes early, enabling rapid response and maintaining security compliance.

Effective file integrity monitoring enables you to:

  • Detect unauthorized file modifications
  • Monitor critical system files
  • Identify security breaches early
  • Maintain security compliance
  • Track file change history
  • Prevent unauthorized access

Key File Integrity Metrics to Monitor

Change Metrics

  • File Modification Count: Number of files modified
  • File Change Frequency: Rate of file changes
  • Unauthorized Changes: Changes not authorized
  • File Deletion Count: Number of files deleted

Integrity Metrics

  • File Checksum Verification: Checksum validation results
  • File Permission Changes: Changes to file permissions
  • File Ownership Changes: Changes to file ownership
  • File Content Changes: Changes to file content

Method 1: Monitor File Integrity with AIDE

Install and Configure AIDE

# Install AIDE
sudo apt-get install aide  # Debian/Ubuntu
sudo yum install aide      # CentOS/RHEL

# Initialize AIDE database
sudo aideinit

# Update AIDE database
sudo aide --update

# Check file integrity
sudo aide --check

Monitor File Changes with AIDE

# Run integrity check
sudo aide --check

# View AIDE report
sudo cat /var/log/aide/aide.log

# Update database after authorized changes
sudo aide --update

Method 2: Monitor File Integrity with Tripwire

Install and Configure Tripwire

# Install Tripwire
sudo apt-get install tripwire  # Debian/Ubuntu
sudo yum install tripwire      # CentOS/RHEL

# Initialize Tripwire database
sudo tripwire --init

# Check file integrity
sudo tripwire --check

# Update database after authorized changes
sudo tripwire --update

Method 3: Monitor File Changes with find and stat

Track File Modification Times

# Find recently modified files
find /etc -type f -mtime -1 -ls

# Find files modified in last hour
find /etc -type f -mmin -60 -ls

# Monitor critical directories
find /etc /usr/bin /usr/sbin -type f -mtime -1 -ls

Monitor File Permissions Changes

# Check file permissions
stat /etc/passwd | grep Access

# Monitor permission changes
find /etc -type f -perm /o+w -ls

# Find files with unusual permissions
find /etc -type f ! -perm 644 -ls

Method 4: Automated File Integrity Monitoring with Zuzia.app

Running these checks by hand works once. Zuzia's agent lets you repeat them on every server without logging in to each one.

How it works in Zuzia

  • Install the Zuzia agent on the server with one command.
  • Zuzia runs a basic security audit on the host and lists what it found. On paid plans, AI summarises the findings in plain language.
  • The agent collects system logs, so you can read them in the panel instead of over SSH.
  • Save the commands from this guide as a scheduled task and choose how often they run. If a command fails, you get an alert right away by email, Slack, Discord, push (through your Pushover account) or SMS (through your Vonage account). On paid plans, AI can read the output and alert you only when it spots a problem.

Setting it up

  1. Add the server in the Zuzia dashboard and install the agent.
  2. Open the host's security audit and logs.
  3. Create a scheduled task with the check commands below, choose the hosts and frequency, and pick your notification channels.

Best Practices for File Integrity Monitoring

1. Monitor Critical System Files

  • Monitor /etc directory files
  • Track system binary files
  • Monitor configuration files
  • Watch security-related files

2. Set Up Baseline Monitoring

  • Establish file integrity baseline
  • Document authorized changes
  • Update baseline after authorized changes
  • Compare current state with baseline

3. Monitor File Permissions

  • Track permission changes
  • Alert on unusual permissions
  • Monitor setuid/setgid files
  • Verify file ownership

4. Implement Change Management

  • Document all file changes
  • Require authorization for changes
  • Review change logs regularly
  • Investigate unauthorized changes

5. Maintain Compliance

  • Meet security compliance requirements
  • Document monitoring procedures
  • Maintain audit trails
  • Report security incidents

Troubleshooting File Integrity Issues

Step 1: Identify File Integrity Problems

When file integrity issues are detected:

  1. Review File Changes:

    • Check file modification times
    • Review file change logs
    • Identify changed files

  2. Verify File Integrity:

    • Compare file checksums
    • Check file permissions
    • Verify file ownership

  3. Investigate Changes:

    • Determine if changes are authorized
    • Review change history
    • Identify change sources

Step 2: Resolve File Integrity Issues

Based on investigation:

  1. Restore Files:

    • Restore files from backups
    • Fix unauthorized changes
    • Update file integrity baseline

  2. Fix Security Issues:

    • Investigate security breaches
    • Fix compromised systems
    • Update security measures

  3. Update Monitoring:

    • Adjust monitoring thresholds
    • Update file integrity baseline
    • Improve change detection

FAQ: Common Questions About File Integrity Monitoring

How often should I check file integrity?

For production servers, continuous automated monitoring is essential. Zuzia.app can check file integrity every few minutes, storing historical data and alerting you when unauthorized changes are detected.

What files should I monitor?

Monitor critical system files including /etc configuration files, system binaries, security-related files, and application configuration files. Focus on files that, if changed, could impact security or system functionality.

How do I handle authorized file changes?

When authorized changes are made, update the file integrity baseline, document the changes, and ensure monitoring systems recognize the changes as authorized. This prevents false alerts while maintaining security.

Can file integrity monitoring impact performance?

File integrity monitoring can impact performance if not configured correctly. Use efficient monitoring tools, monitor only critical files, and schedule checks during low-traffic periods to minimize impact.

Related guides, recipes, and problems

  • Related guides

    • guides--server-security-audit-complete-guide.md
    • guides--monitoring-application-performance-linux.md

  • Related recipes

    • recipes--monitor-file-permissions-changes.md
    • recipes--monitor-recently-modified-files-linux.md

  • Related problems

    • problems--weak-ssh-configuration-security-risk.md

We use cookies to ensure the proper functioning of our website.