Updating the file signature database

The samhain daemon only reads the file signature database on startup (also see the Section called Dynamic database update (modified/disappeared/new files) in the chapter called Configuration — samhain, the file monitor on this). You can update the database while the daemon is running, as long as you don't interfere with its logging (i.e. you should run samhain -t update -l none to make sure the log file is not accessed). Interactive updates are supported with the command line flag --interactive

If you are using samhain in client/server mode and keep the baseline database on the server, then there are two ways to update the database: