On Mon, Sep 17, 2007 at 08:23:03AM -0700, Bill Wohler wrote: > I reinstalled aide and used the Debian configuration per your suggestion. > > MAILSUBJ="Daily AIDE report for $FQDN" > MAILTO=root > QUIETREPORTS=yes > COMMAND=update > COPYNEWDB=ifnochange > LINES=1000 > NOISE="" > AIDEARGS="-V3" > UPAC_CONFDIR="/etc/aide" > UPAC_CONFD="$UPAC_CONFDIR/aide.conf.local.d" > > After spending many hours suppressing output of transient postfix and > mailman files and other nominal activities, I finally got aide not to > report any changes in a 5 minute period.
Care to submit your rules for inclusion in the aide packages? > However, I still got an email, appended below, so it appears that > QUIETREPORTS=yes is not working as advertised. Hmm. > In addition, I would have expected the COPYNEWDB=ifnochange to update my > database in this case, but as you can see, it didn't: > > [EMAIL PROTECTED]:505]# l -tr > total 10296 > -rw------- 1 root root 5250884 Sep 17 07:46 aide.db > -rw------- 1 root root 15823 Sep 17 07:51 aide.conf.autogenerated > -rw------- 1 root root 5250869 Sep 17 07:57 aide.db.new This looks like the aide cron job on your system does not properly detected that there were no changes. aide in etch does not give meaningful return values, so the cron job has to parse aide's output. This has been changed since then, so you might find lenny's aide backported to etch helpful. Greetings Marc -- ----------------------------------------------------------------------------- Marc Haber | "I don't trust Computers. They | Mailadresse im Header Mannheim, Germany | lose things." Winona Ryder | Fon: *49 621 72739834 Nordisch by Nature | How to make an American Quilt | Fax: *49 621 72739835 -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
