I suggest that you start with the example below, use it for a few weeks, and tune it to accommodate your habits. The media containing your aide databases should be physically unmounted between scans. Alternatively, see /usr/doc/aide-$VERSION/contrib for some example scripts that will help you gpg sign your database, for online storage. === /etc/aide.conf sample === database=file:/mnt/usb/aide.db database_out=file:/mnt/usb/aide.db.new gzip_dbout=yes /etc/ld.so.cache p+ftype+l+u+g /etc/ntp/drift p+ftype+l+u+g /boot R /etc R /bin R /lib R /usr/lib R /usr/libexec R /usr/lib64 R /lib64 R /usr/bin R /usr/local/bin R /sbin R /usr/sbin R /usr/local/sbin R =/var/log R