aide
Integrity and confinementPackage: aide
Fingerprint-based intrusion detection: a baseline of the files, then a report of what changed. Worth only as much as a baseline taken on a clean machine and kept off it.
What its options do in the lessons
From the same glossary the lessons render under their commands, so the two cannot disagree.
aide --check- Compares the disk against the existing database and reports the differences, writing no new database. The exit status is a sum: 1 new files, 2 removed, 4 changed.