Samhain | ||
---|---|---|
<<< Previous | Configuration — samhain, the file monitor | Next >>> |
In the Misc section of the configuration file, you can set the interval (in seconds) between succesive file checks:
SetFilecheckTime=value
Alternatively, you can specify a crontab-like schedule with:
FileCheckScheduleOne=schedule
The schedule follows the same rules as crontab(5) entries, with two noteable exceptions: (a) lists are not allowed, and (b) ranges of names (like Mon-Fri) are allowed. See man 5 crontab for details.
If you want to check some files rather often, while doing a more extensive check only sometimes, this is supported as follows:
Enclose all directories for the more extensive check in a %SCHEDULE_TWO ... !%SCHEDULE_TWO block like:
%SCHEDULE_TWO dir=/check/only/once/per/day !\%SCHEDULE_TWO |
Define an optional second schedule with:
FileCheckScheduleTwo=schedule2
This will check all files / directories defined in the config file at schedule2, while directories outside the %SCHEDULE_TWO block, as well as all single files, will be checked at the normal schedule as well.
<<< Previous | Home | Next >>> |
Defining which files/directories to monitor | Up | Initializing, updating, or checking |