The actual use in industry of intrusion detection is negligible, and the systems themselves are nearly worthless.
For what it's worth: we don't generally recommend IDS deployments.
For what it's worth: we don't generally recommend IDS deployments.
(That is not asked out of idle curiosity, and I've been told the worst intrusions hack the kernel so tripwire would likely be useless, but don't know if those are widespread.)
Tripwire is not a total waste of time, like a network IDS would be, but for most startups a minute spent setting up Tripwire is a minute that could be better spent on appsec.
Also with proper hardening you can prevent the kernel from being modified even by root. Things like FreeBSD securelevel that once enabled blocks writing to kernel memory and raw disk devices.
File integrity is also a pain in the ass. You have to keep a database of good file hashes and it can't be stored on the server (or the attacker modifies the known good hashes). Generally you also should not even have the file integrity software on the live server filesystem.
Similarly Network IDS has the flaw that you must have well defined profiles of "normal behavior" so it can identify abnormal behavior. The other option is signature-based but that would only detect known exploits.