Each time aide is run with either the –check or –update option, it always detects differences between the database and the filesystem. Specifically, the mtime and ctime on certain directories:
# aide --check
AIDE found differences between database and filesystem!!
Start timestamp: 2014-01-05 08:03:47
Summary:
Total number of files: 39240
Added files: 0
Removed files: 0
Changed files: 20
---------------------------------------------------
Changed files:
---------------------------------------------------
changed: /usr/sbin
changed: /usr/libexec
changed: /usr/libexec/gcc/x86_64-redhat-linux/4.4.4
changed: /usr/libexec/getconf
changed: /usr/libexec/polkit-1
changed: /usr/libexec/utempter
changed: /usr/libexec/awk
changed: /usr/bin
changed: /usr/lib64
changed: /usr/lib64/pm-utils/bin
changed: /usr/lib64/nss/unsupported-tools
changed: /usr/lib64/sa
changed: /usr/lib64/perl5/CORE
changed: /root
changed: /root/.viminfo
changed: /lib/udev
changed: /bin
changed: /lib64
changed: /lib64/dbus-1
changed: /sbin
--------------------------------------------------
Detailed information about changes:
---------------------------------------------------
Directory: /usr/sbin
Mtime : 2014-01-05 08:00:49 , 2014-01-05 08:01:20
Ctime : 2014-01-05 08:00:49 , 2014-01-05 08:01:20
Directory: /usr/libexec
Mtime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21
Ctime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21
Directory: /usr/libexec/gcc/x86_64-redhat-linux/4.4.4
Mtime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21
Ctime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21
Directory: /usr/libexec/getconf
Mtime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21
Ctime : 2014-01-05 08:00:49 , 2014-01-05 08:01:21
Directory: /usr/libexec/polkit-1
Mtime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21
Ctime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21
Directory: /usr/libexec/utempter
Mtime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21
Ctime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21
Directory: /usr/libexec/awk
Mtime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21
Ctime : 2014-01-05 08:00:50 , 2014-01-05 08:01:21
Directory: /usr/bin
Mtime : 2014-01-05 08:00:57 , 2014-01-05 08:01:29
Ctime : 2014-01-05 08:00:57 , 2014-01-05 08:01:29
Directory: /usr/lib64
Mtime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42
Ctime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42
Directory: /usr/lib64/pm-utils/bin
Mtime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42
Ctime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42
Directory: /usr/lib64/nss/unsupported-tools
Mtime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42
Ctime : 2014-01-05 08:01:09 , 2014-01-05 08:01:42
Directory: /usr/lib64/sa
Mtime : 2014-01-05 08:01:10 , 2014-01-05 08:01:43
Ctime : 2014-01-05 08:01:10 , 2014-01-05 08:01:43
Directory: /usr/lib64/perl5/CORE
Mtime : 2014-01-05 08:01:10 , 2014-01-05 08:01:44
Ctime : 2014-01-05 08:01:10 , 2014-01-05 08:01:44
Directory: /root
Mtime : 2014-01-05 07:59:25 , 2014-01-05 08:03:45
Ctime : 2014-01-05 07:59:25 , 2014-01-05 08:03:45
File: /root/.viminfo
Inode : 267392 , 267393
Directory: /lib/udev
Mtime : 2014-01-05 08:01:14 , 2014-01-05 08:01:48
Ctime : 2014-01-05 08:01:14 , 2014-01-05 08:01:48
Directory: /bin
Mtime : 2014-01-05 08:01:15 , 2014-01-05 08:01:49
Ctime : 2014-01-05 08:01:15 , 2014-01-05 08:01:49
Directory: /lib64
Mtime : 2014-01-05 08:01:16 , 2014-01-05 08:01:50
Ctime : 2014-01-05 08:01:16 , 2014-01-05 08:01:50
Directory: /lib64/dbus-1
Mtime : 2014-01-05 08:01:16 , 2014-01-05 08:01:50
Ctime : 2014-01-05 08:01:16 , 2014-01-05 08:01:50
Directory: /sbin
Mtime : 2014-01-05 08:01:18 , 2014-01-05 08:01:52
Ctime : 2014-01-05 08:01:18 , 2014-01-05 08:01:52
After each execution of aide, the mtime and ctime on these directories are changed. Hence, aide detects and reports these changes.
This is due to prelinking. If you disable prelinking, then this problem will go away. To disable prelinking, modify the configuration file /etc/sysconfig/prelink. Change “PRELINKING=yes” to “PRELINKING=no“. Then manually run /etc/cron.daily/prelink as root. After updating the aide database, subsequent aide checks will not have this problem.
My System Configuration
- CentOS 6.5 x86 64-bit
- Aide 0.14
# aide --version
Aide 0.14
Compiled with the following options:
WITH_MMAP
WITH_POSIX_ACL
WITH_SELINUX
WITH_PRELINK
WITH_XATTR
WITH_LSTAT64
WITH_READDIR64
WITH_ZLIB
WITH_GCRYPT
WITH_AUDIT
CONFIG_FILE = "/etc/aide.conf"