# Check for manual manipulation **URL:** \ **Category:** Get Help\ **Tags:** playbook\ **Created:** [November 26, 2024, 4:16am UTC](https://forum.ansible.com/t/check-for-manual-manipulation/11149 "2024-11-26T04:16:21Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![merrittr](https://avatars.discourse-cdn.com/v4/letter/m/e480ec/32.png) [@merrittr](https://forum.ansible.com/u/merrittr)\ **Post date:** [November 26, 2024, 4:16am UTC](https://forum.ansible.com/t/check-for-manual-manipulation/11149/1 "2024-11-26T04:16:21Z")
We do patching using ansible , but one of our clients is asking if there is a way to test for “drift” …not sure what that means , so they elaborated and asked if there was a way to detect if a system has been manually manipulated , configuration changed. I could just dump previous md5 and compare to current md5 but I am not sure how to approach this ---
**Author:** ![dnmvisser](https://avatars.discourse-cdn.com/v4/letter/d/8e8cbc/32.png) [@dnmvisser](https://forum.ansible.com/u/dnmvisser)\ **Post date:** [November 26, 2024, 5:55am UTC](https://forum.ansible.com/t/check-for-manual-manipulation/11149/2 "2024-11-26T05:55:48Z")
[https://aide.github.io/](https://aide.github.io/) ---
**Author:** ![Jeff\_Pullen](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jeff_pullen/32/5318_2.png) [@Jeff\_Pullen](https://forum.ansible.com/u/Jeff_Pullen)\ **Post date:** [November 26, 2024, 6:02am UTC](https://forum.ansible.com/t/check-for-manual-manipulation/11149/3 "2024-11-26T06:02:25Z")
There are two ways that I think about the question. 1 - Its a question of configuration management and enforcement. If Ansible configured a setting, you can ensure it hasn’t been changed by running it again. This is the easier problem to tackle if you’ve done a good job with idempotency. Stick that job on a schedule and you verify the configuration as often as your schedule permits. 2 - Its a larger question about changes to the system that may happen outside of the files that Ansible directly manages. For that I would suggest Aide, or tools like it. That is purpose built for identify changes to the system and logging them for audits and review. > **[Proof of Concept: Use Ansible to manage the Advanced Intrusion Detection...](https://www.opensourcerers.org/2024/04/22/proof-of-concept-use-ansible-to-manage-the-advanced-intrusion-detection-environment-aide/)** > > This is the follow-up article to my Introduction to the Advanced Intrusion Detection Environment (AIDE). It presents a Proof of Concept (PoC) that shows how AIDE can be remotely controlled using an Ansible role. Knowledge of the introductory article... > **[Better securing the frontlines: Leveraging Ansible Automation Platform and...](https://www.redhat.com/en/blog/better-securing-the-frontlines)** > > A lot of system administrators within the Department of Defense already use the Advanced Intrusion Detection Environment (AIDE). This is mainly because of a Security Technical Implementation Guide (STIG) that states that a file integrity checker must... ---
**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\ **Post date:** [December 10, 2025, 11:55pm UTC](https://forum.ansible.com/t/check-for-manual-manipulation/11149/4 "2025-12-10T23:55:40Z")
Closed on December 10, 2025, 11:55pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.