How do I get cron to email me only when AIDE detects file modification?

Question

I set up a crontab. I've installed AIDE and I have an AIDE database to check for file integrity.

How do I get cron to email me ONLY when files have been modified?

The script:

#!/bin/bash 

if aide -c /etc/aide/aide.conf --check
    then echo "AIDE detected no changes"
else
    echo "Alert!: AIDE detected changes!"

The crontab:

* */12 * * * /root/script.sh | mail root@localhost.com

Or, `if ! aide -c /etc/aide/aide.conf --check; then echo "Alert!: AIDE detected changes!" fi`? or `aide -c /etc/aide/aide.conf --check || echo "Alert!: AIDE detected changes!"`? — David C. Rankin, May 23 '20 at 05:52
I think you need to do more than that. On my system `mail foo@bar < /dev/null` sends an email with an empty body!! — Stephen C, May 23 '20 at 06:00
Please don't make more work for other people by vandalizing your posts. By posting on the Stack Exchange network, you've granted a non-revocable right, under the [CC BY-SA 4.0 license](//creativecommons.org/licenses/by-sa/4.0/), for Stack Exchange to distribute that content (i.e. regardless of your future choices). By Stack Exchange policy, the non-vandalized version of the post is the one which is distributed. Thus, any vandalism will be reverted. If you want to know more about deleting a post please see: [How does deleting work?](//meta.stackexchange.com/q/5221) — Dharman, May 23 '20 at 23:39
Any more of this and we will need to mod-flag this Question to have it locked by the diamond moderators. — Stephen C, May 24 '20 at 01:22

Stephen C · Answer 1 · 2020-05-24T05:11:04.117

Use the MAILTO crontab variable rather then piping to mail. Then change your script so that it doesn't output anything unless there is a problem:

#!/bin/bash 
aide -c /etc/aide/aide.conf --check || echo "Alert!: AIDE detected changes!"

The crontab:

MAILTO=root@localhost.com
* */12 * * * /root/script.sh 
MAILTO=""

Notes:

You can use a simple (local) username instead; e.g. root.
You need to have set up mail handling on your system; e.g. delivery to local mailboxes or relaying via an external SMTP serice provider such as Gmail. That is beyond the scope of this Q&A.
The MAILTO="" is to stop following cron rules from sending mails. If you want them to do that, leave it out. It must be MAILTO="" not MAILTO=. (Cron is not implementing shell syntax here. Another clue is that the you can put spaces around the = which you can't do with shell syntax.)
Setting of variables in crontab is not part of the POSIX spec. There have been many implementations of cron over the years and not all of them support variable setting. Check what man 5 crontab says on your system.

Alternatively, you could use ... | mailx -E root@localhost.com rather than ... | mail root@localhost.com. This will skip sending the mail if the body (i.e. stdin) is empty.

Basile Starynkevitch · Answer 2 · 2020-05-23T05:53:21.173

How do I get cron to email me ONLY when files have been modified?

If you are on Linux with a local file system (e.g. ext4(5) or BTRFS), consider using inotify(7) facilities and then install incrond (on Debian or Ubuntu: the incron package) and use incrontab(5).

Be aware that incron and inotify don't work on remote file systems such as NFS or SMB/CIFS or on pseudofile systems like proc(5).

If you cannot use incron you'll need to use find(1) and perhaps stat(1) in your shell script periodically called by cron

BTW, some files (e.g. those under /var/run/, see hier(7) for more) are very often modified. And so are the data files handled by RDBMS such as PostGreSQL

Regarding AIDE, be sure to read its documentation. Since it is open source and even free software, consider studying then improving its code (e.g. to use inotify).

score 1 · Answer 3 · answered Dec 19 '20 at 22:04

We wrote a Perl script that sends out an email if something went wrong and updates the database so that this email won't go out again.

#!/usr/bin/perl
my $aide =  "/usr/sbin/aide -c /etc/aide.conf";
my $email = "security\@your-domain.com";
my $timestamp = `/bin/date +\%Y-\%m-\%d.\%H-\%M`;
my $output = "";
my $added = -1;
my $removed = -1;
my $changed = -1;
my $warning = 0;
my $found_no_differences = 0;
open(AIDE, "$aide --check|");
while (my $line=<AIDE>) {
    chomp($line);
    $output = $output.$line."\n";
    if ($line =~ /Added entries\:\s*(\w+)/) { $added = $1; }
    if ($line =~ /Removed entries\:\s*(\w+)/) { $removed = $1; }
    if ($line =~ /Changed entries\:\s*(\w+)/) { $changed = $1; }
    if ($line =~ /WARNING\:/) { $warning = $warning + 1; }
    if ($line =~ /AIDE found NO differences/) { $found_no_differences = 1; }
}
close(AIDE);
if ($found_no_differences > 0) { exit(0); }
if ($added > 0 || $removed > 0 || $changed > 0 || $warning > 0 || $added == -1 || $changed == -1) {
    open MAIL, "|mail -s 'AIDE $timestamp' $email";
    print MAIL $output;
    close MAIL;
    system("$aide --init");
    system("mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz");
}

score 0 · Answer 4 · answered Jul 30 '21 at 09:09

by default aide sends email to local root user, it's probably best to create an alias for the local root user to noc@domain.com or whatever you use for your incoming email address, this way you not only get aide emails but also other system mail that's destined for the user root

How do I get cron to email me only when AIDE detects file modification?

4 Answers4