List of configuration file options

General

The configuration file for samhain is named samhainrc by default. Also by default, it is placed in /etc. (Name and location is configurable at compile time). The distribution package comes with a commented sample configuration file.

This section introduces the general structure of the configuration file. Details on individual entries in the configuration files are discussed in the Section called Defining which files/directories to monitor in the chapter called Configuration — samhain, the file monitor> (which files to monitor), the Section called Severity levels and classes of log messages in the chapter called Configuration of logging facilities> (what should be logged, which logging facilities should be used, and how these facilities are properly configured), and the Section called Monitoring login/logout events in the chapter called Configuration — samhain, the file monitor> (monitoring login/logout events).

The configuration file contains several sections, indicated by headings in square brackets. Each section may hold zero or more key=value pairs. Keys are not case sensitive, and space around the '=' is allowed. Blank lines and lines starting with '#' are comments. Everything before the first section and after an [EOF] is ignored. The [EOF] end-of-file marker is optional. The file thus looks like:

  # this is a comment       
  [Section heading]   
  key1=value     
  key2=value     
  
  [Another section]    
  key3=value     
  key4=value     

TipTIP
 

Each section may occur multiple times.

NoteNOTE
 

You can explicitely end the configuration file with an [EOF] (on a seperate line), but this is not required, unless there is junk beyond.