Samhain | ||
---|---|---|
<<< Previous | Next >>> |
The configuration file for samhain is named samhainrc by default. Also by default, it is placed in /etc. (Name and location is configurable at compile time). The distribution package comes with a commented sample configuration file.
This section introduces the general structure of the configuration file. Details on individual entries in the configuration files are discussed in the Section called Defining which files/directories to monitor in the chapter called Configuration — samhain, the file monitor> (which files to monitor), the Section called Severity levels and classes of log messages in the chapter called Configuration of logging facilities> (what should be logged, which logging facilities should be used, and how these facilities are properly configured), and the Section called Monitoring login/logout events in the chapter called Configuration — samhain, the file monitor> (monitoring login/logout events).
The configuration file contains several sections, indicated by headings in square brackets. Each section may hold zero or more key=value pairs. Keys are not case sensitive, and space around the '=' is allowed. Blank lines and lines starting with '#' are comments. Everything before the first section and after an [EOF] is ignored. The [EOF] end-of-file marker is optional. The file thus looks like:
# this is a comment [Section heading] key1=value key2=value [Another section] key3=value key4=value |
![]() | TIP |
---|---|
Each section may occur multiple times. |
![]() | NOTE |
---|---|
You can explicitely end the configuration file with an [EOF] (on a seperate line), but this is not required, unless there is junk beyond. |
Conditional inclusion of entries for some host(s) is supported via any number of @hostname/@end directives. @hostname and @end must each be on separate lines. Lines in between will only be read if hostname (which may be a regular expression) matches the local host.
Likewise, conditional inclusion of entries based on system type is supported via any number of $sysname:release:machine/$end directives. sysname:release:machine for the local host can be determined using the command uname -srm and may be a regular expression.
A '!' in front of the '@'/'\$' will invert its meaning. Conditionals may be nested up to 15 levels.
@hostname # only read if hostname matches local host @end !@hostname # not read if hostname matches local host @end # $sysname:release:machine # only read if sysname:release:machine matches local host $end !$sysname:release:machine # not read if sysname:release:machine matches local host $end |
<<< Previous | Home | Next >>> |
yule | Files to check |