I'd like to emphasize the canary file. This is a file that you should never access in normal operations. Thus, if the file was in fact accessed, that is a sign that something is scanning your file system.

Depending on the threat, such a scan might be a good reason to pull the cord from the mains socket. You don't want to let a normal shutdown occur, rather pull the cord and mount the disk on another system to recover / analyze.

what a horrible interface

  aide 
  Couldn't open file /var/lib/aide/please-dont-call-aide-without-parameters/aide.db for reading

  aide -i
  Couldn't open file /var/lib/aide/please-dont-call-aide-without-parameters/aide.db.new for writing

I suppose, but it's not really made as a one off run-a-command type tool. It needs set up so that you can compare now to then.

Having no parameters specified doing something real is probably not desired, as it would overwrite the DB that your aide Cron job is running.

That's why your Linux distro (not aide) picked those funny defaults.

I thought tripwire was the standard.. happy to know another name.

Tripwire got very stale after they split off a non open source commercial version.

Aide filled that gap. I believe most people prefer it to the open source tripwire.