/usr/share/doc/samhain/manual.html/timing-file-checks.html

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN""http://www.w3.org/TR/html4/loose.dtd">
<HTML
><HEAD
><TITLE
>Timing file checks</TITLE
><META
NAME="GENERATOR"
CONTENT="Modular DocBook HTML Stylesheet Version 1.79"><LINK
REL="HOME"
TITLE="The Samhain Host Integrity Monitoring System"
HREF="index.html"><LINK
REL="UP"
TITLE="Configuring samhain, the host integrity monitor"
HREF="file-monitor.html"><LINK
REL="PREVIOUS"
TITLE="Excluding files and/or subdirectories (All except &#8230;)"
HREF="all-except.html"><LINK
REL="NEXT"
TITLE="Initializing, updating, or checking"
HREF="initializing-updating-checking.html"><LINK
REL="STYLESHEET"
TYPE="text/css"
HREF="./docbook.css"></HEAD
><BODY
CLASS="SECT1"
BGCOLOR="#FFFFFF"
TEXT="#000000"
LINK="#0000FF"
VLINK="#840084"
ALINK="#0000FF"
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/header.html"--><!--#endif --><DIV
CLASS="NAVHEADER"
><TABLE
SUMMARY="Header navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TH
COLSPAN="3"
ALIGN="center"
>The Samhain Host Integrity Monitoring System</TH
></TR
><TR
><TD
WIDTH="10%"
ALIGN="left"
VALIGN="bottom"
><A
HREF="all-except.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="80%"
ALIGN="center"
VALIGN="bottom"
>Chapter 5. Configuring <SPAN
CLASS="APPLICATION"
>samhain</SPAN
>, the host integrity monitor</TD
><TD
WIDTH="10%"
ALIGN="right"
VALIGN="bottom"
><A
HREF="initializing-updating-checking.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
></TABLE
><HR
ALIGN="LEFT"
WIDTH="100%"></DIV
><DIV
CLASS="SECT1"
><H1
CLASS="SECT1"
><A
NAME="TIMING-FILE-CHECKS"
>5.6. Timing file checks</A
></H1
><P
>In the <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Misc</I
></SPAN
> section of the configuration file,
  you can set the interval (in seconds) between succesive file checks:</P
><P
><B
CLASS="COMMAND"
>SetFilecheckTime=<TT
CLASS="REPLACEABLE"
><I
>value</I
></TT
></B
></P
><P
>Alternatively, you can specify a crontab-like schedule with:</P
><P
><B
CLASS="COMMAND"
>FileCheckScheduleOne=<TT
CLASS="REPLACEABLE"
><I
>schedule</I
></TT
></B
></P
><P
>  The schedule follows the same rules as crontab(5) entries, with two
  noteable exceptions: (a) <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>lists</I
></SPAN
> are not allowed, 
  and (b) <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>ranges</I
></SPAN
>
  of names (like Mon-Fri) are allowed. See <B
CLASS="COMMAND"
>man 5 crontab</B
> 
  for details. You can specify a list of schedules, with separate
  FileCheckScheduleOne=&hellip; directives on separate lines.</P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Note</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>If you need a list in your schedule, you can either use 
steps (like */2 for 'every two
minutes/hours/...), or you can specify a list of schedules, with separate
FileCheckScheduleOne=&hellip; directives on separate lines. </P
></TD
></TR
></TABLE
></DIV
><DIV
CLASS="SECT2"
><H2
CLASS="SECT2"
><A
NAME="SECOND-SCHEDULE"
>5.6.1. Using a second schedule</A
></H2
><P
>  If you want to check some files rather often, while doing a more 
  extensive check only sometimes, this is supported as follows:</P
><P
><P
></P
><UL
><LI
><P
>  Enclose all directories for the more extensive check in a
  %SCHEDULE_TWO ... !%SCHEDULE_TWO block like:
  </P
><PRE
CLASS="PROGRAMLISTING"
>  %SCHEDULE_TWO
  dir=/check/only/once/per/day
  !%SCHEDULE_TWO 
  </PRE
></LI
><LI
><P
>  Define an optional second schedule as follows (similar to FileCheckSchedule,
  you can specify a list of schedules):
  </P
><P
>  <B
CLASS="COMMAND"
>FileCheckScheduleTwo=<TT
CLASS="REPLACEABLE"
><I
>schedule2</I
></TT
></B
>
  </P
></LI
></UL
></P
><P
>  <SPAN
CLASS="emphasis"
><I
CLASS="EMPHASIS"
>Rules:</I
></SPAN
></P
><P
><P
></P
><OL
TYPE="1"
><LI
><P
>   All files and directories will always be checked at
   FileCheckScheduleTwo.
   </P
></LI
><LI
><P
>   All single files (file=&hellip;) will always be checked at both
   FileCheckScheduleOne and FileCheckScheduleTwo (rationale: this
   is required to check for missing/added files in directories).
   </P
></LI
><LI
><P
>   All directories outside the %SCHEDULE_TWO
   block will be checked at both
   FileCheckScheduleOne and FileCheckScheduleTwo.
   </P
></LI
><LI
><P
>   All directories inside the %SCHEDULE_TWO
   block will be checked at
   FileCheckScheduleTwo only.
   </P
></LI
></OL
></P
><DIV
CLASS="NOTE"
><P
></P
><TABLE
CLASS="NOTE"
WIDTH="100%"
BORDER="0"
><TR
><TD
WIDTH="25"
ALIGN="CENTER"
VALIGN="TOP"
><IMG
SRC="./stylesheet-images/note.gif"
HSPACE="5"
ALT="Note"></TD
><TH
ALIGN="LEFT"
VALIGN="MIDDLE"
><B
>Missing files</B
></TH
></TR
><TR
><TD
>&nbsp;</TD
><TD
ALIGN="LEFT"
VALIGN="TOP"
><P
>    If you are using a second schedule, the full check for missing files will
    only be done at FileCheckScheduleTwo. For paths directly defined
    in the configuration, e.g. with <B
CLASS="COMMAND"
>file=...</B
>, 
    <SPAN
CLASS="APPLICATION"
>samhain</SPAN
> will detect immediately if the
    file is missing, if the path is checked at FileCheckScheduleOne.
  </P
></TD
></TR
></TABLE
></DIV
></DIV
></DIV
><DIV
CLASS="NAVFOOTER"
><HR
ALIGN="LEFT"
WIDTH="100%"><TABLE
SUMMARY="Footer navigation table"
WIDTH="100%"
BORDER="0"
CELLPADDING="0"
CELLSPACING="0"
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
><A
HREF="all-except.html"
ACCESSKEY="P"
>Prev</A
></TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="index.html"
ACCESSKEY="H"
>Home</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
><A
HREF="initializing-updating-checking.html"
ACCESSKEY="N"
>Next</A
></TD
></TR
><TR
><TD
WIDTH="33%"
ALIGN="left"
VALIGN="top"
>Excluding files and/or subdirectories (All except &hellip;)</TD
><TD
WIDTH="34%"
ALIGN="center"
VALIGN="top"
><A
HREF="file-monitor.html"
ACCESSKEY="U"
>Up</A
></TD
><TD
WIDTH="33%"
ALIGN="right"
VALIGN="top"
>Initializing, updating, or checking</TD
></TR
></TABLE
></DIV
><!--#if expr="! ($HTTP_USER_AGENT = /MSIE/)"--><!--#include virtual="/resources/ssi/footer.html"--><!--#endif --></BODY
></HTML
>
samhain 3.1.0-5ubuntu1 / usr / share / doc / samhain / manual.html / timing-file-checks.html
