Very informative post. +1

The OP asked "which is preferred" by the internet community. So, here is some original research:

Googled: linux aide hids good
940,000 results

Googled: linux tripwire hids good
427,000 results

So, based on this scientific method, it's official that AIDE is more preferred by the internet.

Yes, I know what the OP asked for. Preference might not get him what he wants in the end, though. There've been soooo many "what do you guys think of A vs B" on these forums that it is just flat-out crazy to assume that everyone will always be willing to offer their 2 cents without OPs doing a bit of homework first...right? Because you REALLY don't have any idea of the criteria that the OP may need to consider the product a good fit for his network environment.

A Google query on counted hits isn't a fair assessment, IMO. I fail to see what's scientific in relying on Google to show a hit count of what's preferred based on a few rather raw key words.

The LQ Sec forum should be attempting to educate people regarding security. The first step should be to push them to evaluate for themselves, also, based on the information they researched and asked about. Sort of similar to any advocacy program. It shouldn't have anything to do with preference, really. What it will come down to, if this place pushes preference, is that someone will ask for preference of a given security product, that someone installs it based on preference and without doing their own research or testing, then blame these forums later because we advocated the product that broke that someone's network. Some of the posts in this thread were really good, offering pros and cons. Others are, to be honest, not really informative.

I hope this isn't coming off as rude, because that's not the point. If all we were to do was give our preferences, we aren't really serving anything.

** Yeah, I saw you were having fun. Sorry I misinterpreted it a bit.

1 members found this post helpful.

Yeah, I understand file integrity checkers are considered a HIDS by many. However, by that same definition, ClamAV, rkhunter, and a home made script that just checks whether a NIC is in promiscuous mode can be considered HIDS. Calling tripwire a File Integrity Checker/Verifier to me is just more accurate, and is used to distinguish it from software that is in another league like Samhain and OSSEC as far as capabilities.

I make the same kind of distinctions when talking about NIDS. I wouldn't like to call something like Ngrep or PADS used to detect attacks a NIDS either, because as far as features and capability go it can't compare with something like Snort.

Richard Bejtlich quote: "If you want to sort Snort alerts in a Web browser, BASE is great. If you want to use Snort alerts as one possible beginning of a network security investigation, Sguil is essential."

Here's a good post saying Sguil isn't a SIEM as well. http://taosecurity.blogspot.com/2006...d-like-to.html

Looks like it. But thats not a crime.

Then we are all going to have to get together and re-train the *entire* world, 5+ Billion People, to base decisions off of their own research, rather than other peoples opinions.

And, the paid version of Tripwire is my preference.

After reading the about the paid version of tripwire it seems that aside from being a file integrity checker- it is a lesser version of selinux and just another logger being an alternative to syslog. am i wrong on this?

Also, Splunk is just a manager for log files that gives charts, guis, and logrotate-like functions. I don't think Splunk has much do with being a file integrity checker or a IDS at all.

This is completely untrue. And in fact if you do go over your limit you get a warning message for the next 14 days. It does not delete any data and it does not stop indexing.

nomb

Here are some videos on Splunk that show what it's for, but remember the free version is limited. This blog post shows how it's related to OSSEC.

I'm only saying OSSEC or OSSEC + Splunk is a possible solution that might work for you. Like what unixfool said, if Tripwire doesn't cut it, then it's up to you to try out other suggestions and decide which one works best in your environment.

If the 5+ billion people visit here, yes. If the goal is to educate people, sooner or later, they're going to have to try things on their own. I know the LQ Sec forum charter...I know what the mods are looking for in making these forums THE security forum for Linux. There's nothing wrong with having posters conduct their own investigation as to what would be a preferred tool. Opinions are OK, but that's all they are, and I'm sure you know that saying about opinions. Sometimes, more than opinions are needed.

Can you imagine a place that had visitors that never conducted research before asking questions? Oh yeah...that's most of the internet forums! There's no reason why we can't be a bit different here.

You definitely can't just go off of opinion only when in a work environment...you'll eventually get fired or let go.