Samhain | ||
---|---|---|
<<< Previous | Configuration — samhain, the file monitor | Next >>> |
In the Misc section of the configuration file, you can choose between initializing the database, updating it, or checking the files against the existing database:
ChecksumTest=init|update|check|none
If you use the mode none, you should specify on the command line one of init, update, or check, like: samhain -t check
As of version 1.8.1, there is a new command line flag --interactive to enable interactive updates. If you use this flag together with -t update, you will be asked if the database entry should be updated, whenever samhain encounters a modified file.
<<< Previous | Home | Next >>> |
Timing file checks | Up | The file signature database |