Configuration — samhain, the file monitor
The samhain file monitor checks the integrity of files by comparing them against a database of file signatures, and notify the user of inconsistencies. The level of logging is configurable, and several logging facilities are provided.
samhain can be used as a client that forwards messages to the server part (yule) of the samhain system, or as a standalone program (for single hosts).
samhain can be run as a background process (i.e. a daemon), or it can be started at regular intervals by cron.
 | TIP |
|---|---|
It is recommended to run samhain as daemon, because
|
Usage overview
To use samhain, the following steps must be followed:
The configuration file must be prepared (the Section called Defining which files/directories to monitor>, the Section called Severity levels and classes of log messages in the chapter called Configuration of logging facilities>, and the Section called Monitoring login/logout events> for details).
All files and directories that you want to monitor must be listed. Wildcard patterns are supported.
The policies for monitoring them (i.e. which modifications are allowed and which not) must be chosen.
Optionally, the severity of a policy violation can be selected.
The logging facilities must be chosen, and the threshold level of logging should be defined To activate a logging facility, its threshold level must be different from none.
Eventu and the alert
LOG_ALERT
Messages larger than 960 chars will be split into several messages. By default, samhain will use the identity 'samhain', the syslog facility LOG_AUTHPRIV, and will log its PID (process identification number) in addition to the message.
The syslog facility can be modified via the directive SyslogFacility=command>LOG_xxx in the Misc section of the configuration file.