samhain file integrity scanner | online documentation

Frequently Asked Questions for Samhain

Rainer Wichmann

If you encounter problems after installing samhain, disable daemon mode and run it in the foreground with samhain --foreground [more options] for debugging.
If you have problems getting client/server mode to work, please check the HOWTO client+server troubleshooting document.

FAQ Revised: Wednesday 14 January 2015 20:41:15

Table of Contents

1. Most frequently

1.1. Owner not trustworthy / Group writeable and member not trustworthy
1.2. samhain exits with the message "Untrusted path" for config/log/pid/database files
1.3. It does not log anything / Can't stop logging to console
1.4. Client cannot self-resolve, but nslookup works fine
1.5. Server logs hostname instead of FQDN (or vice versa)

2. Build and install

2.1. [Fedora Core] Cannot compile with --enable-khide
2.2. [Fedora Core] Cannot compile with --with-kcheck
2.3. "make" loops infinitely !
2.4. Why does static compiling (--enable-static) on Solaris fail ?
2.5. Compilation fails with '/usr/bin/ld: cannot find -lnss_files'
2.6. The executable is corrupted after installation
2.7. --enable-xml-log has no effect
2.8. ./install-sh: strip: not found (Solaris)
2.9. What is sh_tiger1.s?
2.10. Why does static compiling (--enable-static) on MaxOS X fail ?
2.11. Why does compiling with MySQL fail on Solaris ?

3. File checking

3.1. How can I exclude a (sub-)directory ?
3.2. In messages about policy violations, what does the code after POLICY [XYZ] mean ?
3.3. Does samhain support prelink ?
3.4. I get error messages about 'subdirectory count != hardlinks'

4. Client/Server

4.1. I don't want to poke a hole into my firewall to let the client connect to the server !
4.2. The client sends 127.0.0.1 (or some other numerical address) as its name to the log server
4.3. The server wants to send rc.ip-adress rather than rc.fqdn to the client