Modules

Samhain
Prev | Chapter 5. Configuring samhain, the file monitor | Next

# 5.16. Modules

samhain has a programming interface that allows to add modules written in C. Basically, for each module a structure of type struct mod_type, as defined in `sh_modules.h`, must be added to the list in `sh_modules.c`.

This structure contains pointers to initialization, timing, checking, and cleanup functions, as well as information for parsing the configuration file.

For details, in the source code distribution check the files `sh_modules.h, sh_modules.c`, as well as e.g. `utmp.c, utmp.h`, which implement a module to monitor login/logout events. There is also a HOWTO written by eircom.net Computer Incident Response Team.

Prev | Home | Next
Checking for open ports | Up | Performance tuning