Originally Posted by unSpawn
Problem is you don't tell us what you monitor and how. Back in the days when I ran AIDE I used to use separate databases for system files under control of root that often change little (/bin, /sbin, /etc, etc, etc) and ran separate AIDE cron jobs at different intervals.
I installed it, and it started sending me huge emails. That's the extent of my knowledge of AIDE. I assume it's monitoring "everything", and as to "how", however it works out of the box.
This is part of my problem... when it's sending me enormous emails listing tens of thousands of files, there isn't anything I can do with that. I want to tell it, "Forget about everything. Start at zero. Tomorrow, tell me what's changed from zero." How do I do that?