Previously I use AIDE on CentOS 7, and it was easy to include and exclude AIDE folder from scanning
There was already predefined rules that it can include or exclude folder like below:
# Exclude subfolder !/usr/src/ # Include this folder with rule defined in CONTENT_EX /usr/ CONTENT_EX
but, with the new version of AIDE starting
Debian 10, I don't seems to understand how this folder is included or excluded. But I just found out that they have this bunch of predefined rules in here:
/etc/aide/aide.conf.d. How does this new AIDE know which folder to include and what rule to use when it is scanning for file or folder changes?
Another question is: What is the best practice way to write the new excluded or included folder? Should we put new rule in
/etc/aide/aide.conf.d ? Found the
hidden doc here
https://aide.github.io/doc/ but it does not mention anything about this.
hidden because this documentation is not published in the frontpage of
aide.github.io but you need to type the sub url like this to get into that