When should you create the initial database for a Linux file integrity checker?

Creating the database before patching records a potentially vulnerable state as the trusted baseline, causing every legitimate patch-related file change to register as a false positive alert.

Creating the database after a compromise records the already-altered or attacker-modified file state as the trusted baseline, making the integrity checker blind to the existing compromise.

Creating the initial database before a system has been compromised captures verified file hashes, sizes, and attributes in a known-good state; any subsequent unauthorized modification is then detectable because the current file state will differ from this clean baseline, triggering an alert.

Creating the database during an active attack is unreliable because files may already be in the process of being modified, producing a corrupted or attacker-influenced baseline that cannot serve as a valid reference.