The config file should not be kept on the target machine. The attacker could read the config file and alter it or even if he does alter it he could place his rootkit to place that Aide does not check. So the read-only media should be accessible only during the check. Now you are all set to go. You can now check the integrity of the files.
Aide now reads the database and compares it to the files found on disk.
Aide may find changes in places that might not expect. For instance tty devices often change owners and permissions. You may want to read long reports and that is up to you to decide. But most of us do not have the time or the inclination read through tons of garbage every day. So you should trim the config file to include only the files and attributes of certain files that should not change.