||09-22-2012 01:10 PM
Thank you for your reply, Aide isn't to popular and I am having trouble getting answers.
The /var/spool/cron/lastrun/ is to say "do all the attributes but don't do modification or ctime checks of this one directory(does not apply to children)). My problem is that the files underneath /var/spool/cron/lastrun/ already existed before I ran aide -i(initialized) but yet the newly initialized database doesn't contain them. Then when I run a check using that database to verify against, it finds the new files and reports them. This is even more confusing because it is using the same config/attributes as when the database was created.