The baseline is the trusted snapshot of the filesystem.
Every integrity check compares the live system against it, so the baseline defines what "known good" means. T
his tab manages it.
¶ Concept — two very different operations
- Rebuild baseline
Take a brand-new snapshot of the current filesystem from scratch (aide --init).
Use this on first setup, or after a major, fully-trusted change (e.g. a planned upgrade) when you want a clean reference.
It absorbs the current state wholesale.
- Update baseline
Promote the already-approved changes into the baseline (aide --update).
This is the routine operation: you review events, approve the legitimate ones, then update so they stop being reported.
¶ The baseline gate (why "Update" may be disabled)
Update baseline is refused while any event is still New or Suspect.
This is the core safety property:
the baseline must never silently launder an unreviewed or suspicious change into "expected".
Approve or resolve every open event first (see Events);
Then Update becomes available.
¶ How to use it
- First run: Rebuild baseline (usually done automatically when you enable the feature).
- Routine:
triage events > approve the legitimate ones > Update baseline. - Only one scan runs at a time. If a check or a rebuild is already in progress, a second request is declined cleanly ("a scan is already running") rather than failing — just retry once it finishes.
Never rebuild the baseline blindly to make events disappear — that hides exactly the tampering you deployed AIDE to catch. Review first, then update.