In this episode of Linux Server Admin with Fexingo, Lucas and Luna dive into AIDE (Advanced Intrusion Detection Environment) for monitoring config file drift on Linux servers. They walk through a real example: a misconfigured Apache virtual host that went unnoticed for weeks after a junior admin changed a DocumentRoot path without updating the change log. Lucas explains how AIDE builds a baseline database of file hashes, then runs periodic checks to flag unauthorized modifications. They cover initialization, configuration /etc/aide/aide.conf, rule groups like 'Normal' and 'DataOnly', cron scheduling, and what to do when AIDE alerts on an expected change. The episode also touches on AIDE's database storage options and the tension between security and operational noise. Perfect for sysadmins who want to catch configuration drift before it becomes an outage.