- Home
- File Integrity Monitoring Software
- Vigil Baseline
Vigil Baseline
What it is
Vigil Baseline is a file integrity monitor for one Linux desktop or laptop. It records a known-good snapshot of watched files, including hashes, permissions, ownership, inode, capabilities, extended attributes, and SELinux or AppArmor context. It watches filesystem events with kernel fanotify and falls back to inotify, then checks changes against that snapshot. On FID-capable Linux 5.1+ kernels, it supports real-time coverage across event classes; on older kernels, scheduled scans detect some event types. Changes enter a crash-safe write-ahead log and an HMAC-chained audit log, using BLAKE3 hashing. Vigil remains silent unless a watched file changes, with optional desktop notifications through notify-send. Setup uses an interactive welcome configuration that takes about ninety seconds and can be rerun. The vigil-baseline package is installed with apt or dnf after repository setup, and signed packages and repository metadata are updated through the package manager. It is free under GNU GPL v3.0 only for most users; a commercial license is available for proprietary use.
For and against
For
- Records file attributes in a known-good snapshot.
- Uses BLAKE3 hashing and an HMAC-chained audit log.
- Optional desktop alerts can use notify-send.
- Signed packages are updated through the package manager.
- Interactive setup can be safely rerun.
Against
- Does not block, quarantine, or kill processes or files.
- Not designed for servers, headless hosts, or containers.
- No fleet management or central reporting.
- Real-time coverage varies on older kernels.
The verdict
Vigil Baseline provides file integrity monitoring and audit records for one Linux desktop. It does not provide automated response, fleet oversight, or central reporting.
Who it suits
Vigil suits a human operator who wants file-change monitoring on a Linux desktop distribution such as Arch, Debian, Ubuntu, or Fedora. It is intended for a single desktop or laptop, not server or fleet management.
Plans and prices
Vigil Baseline
GPL v3.0 for most users · commercial license available for proprietary use
Read 7 Oct 2026 · github.com
On the record
- Audit trail
- Changes are recorded in a crash-safe write-ahead log and an HMAC-chained audit log.github.com · read 7 Oct 2026
- Baseline
- It records file hashes, permissions, ownership, inode, capabilities, extended attributes, and SELinux or AppArmor context in a known-good snapshot.github.com · read 7 Oct 2026
- Daemon security
- The systemd unit is described as hardened with MemoryMax, PrivateTmp, NoNewPrivileges, and minimal capabilities.vigilbaseline.com · read 7 Oct 2026
- Deployment limits
- The project says it is for one Linux desktop and does not provide fleet management or central reporting.github.com · read 7 Oct 2026
- File watching
- It watches filesystem events through fanotify, with an inotify fallback, and compares events against the baseline.github.com · read 7 Oct 2026
- Integrations
- The README identifies a signal socket and webhook as the only integration points, both disabled by default and outbound-only when enabled.github.com · read 7 Oct 2026
- Integrity records
- It uses BLAKE3 hashing and an HMAC-chained audit log.vigilbaseline.com · read 7 Oct 2026
- Kernel coverage
- On FID-capable Linux 5.1+ kernels it supports real-time coverage across event classes; on older kernels scheduled scans detect some event types.github.com · read 7 Oct 2026
- License
- The source code is offered under GNU GPL v3.0 only or a commercial license.github.com · read 7 Oct 2026
- Limitations
- Vigil is not an EDR and does not kill, quarantine, or block processes or files.vigilbaseline.com · read 7 Oct 2026
- Maker
- The repository identifies Louis Nelson Jr. as the copyright holder and describes lousclues as the project maker.github.com · read 7 Oct 2026
- Maker profile
- The maker's site says Lou makes small software and lists Vigil as an active Linux file integrity monitor.lousclues.com · read 7 Oct 2026
- Monitoring
- It uses kernel fanotify with an inotify fallback to watch filesystem changes.vigilbaseline.com · read 7 Oct 2026
- Network and telemetry
- The README says Vigil has no telemetry and makes no network calls by default.github.com · read 7 Oct 2026
- No automatic response
- Vigil does not kill processes, quarantine files, or block execution, and the README says it is not an EDR.github.com · read 7 Oct 2026
- Notable limits
- It is not designed for servers, headless hosts, containers, Kubernetes, fleets, multi-tenant systems, central reporting, or remote control.github.com · read 7 Oct 2026
- Notifications
- Notifications are storm-suppressed and sent to the desktop session using notify-send when available.github.com · read 7 Oct 2026
- Package installation
- The installable package is named vigil-baseline and is installed with apt or dnf after repository setup.vigilbaseline.com · read 7 Oct 2026
