File integrity monitoring
Continuously checking whether files that should not change, such as system binaries or configuration files, have actually been modified.
What it actually catches that logs might miss
An attacker who successfully covers their tracks in log files can still leave behind modified system binaries or configuration files. File integrity monitoring compares the current state of protected files against a known-good baseline, catching changes regardless of whether the change itself was logged.
The trade-off in how it is used
Monitoring too many files, or files that are expected to change frequently as part of normal operation, produces a flood of noise that makes real alerts easy to miss. Effective setups focus on files that genuinely should not change without a deliberate, tracked action.
Frequently asked questions
What tools are commonly used for this on Linux?
AIDE and Tripwire are two long-established options, alongside broader monitoring platforms that include file integrity checks as one feature among several.
How often should a baseline be updated?
Whenever a legitimate, planned change is made to a monitored file, such as a deliberate configuration update, so the new state becomes the trusted baseline going forward.
Can file integrity monitoring detect a breach that already happened before it was set up?
No. It can only detect changes going forward from when the baseline was established, which is why setting it up early, before an incident, matters.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab