List of configuration file options

Samhain
Prev |  | Next

# Appendix C. List of configuration file options

# C.1. General

The configuration file for samhain is named `samhainrc` by default. Also by default, it is placed in `/etc`. (Name and location is configurable at compile time). The distribution package comes with a commented sample configuration file.

This section introduces the general structure of the configuration file. Details on individual entries in the configuration files are discussed in Section 5.4> (which files to monitor), Section 4.1> (what should be logged, which logging facilities should be used, and how these facilities are properly configured), and Section 5.11> (monitoring login/logout events).

The configuration file contains several sections, indicated by headings in square brackets. Each section may hold zero or more key=`value` pairs. Keys are not case sensitive, and space around the '=' is allowed. Blank lines and lines starting with '#' are comments. Everything before the first section and after an [EOF] is ignored. The [EOF] end-of-file marker is optional. The file thus looks like:

      # this is a comment
      [Section heading]
      key1=value
      key2=value

      [Another section]
      key3=value
      key4=value

For boolean values the following are equivalent (case-insensitive): True, Yes, or 1. Likewise, the following are equivalent (case-insensitive): False, No, or 0.

In lists, values can be separated by space, tabs, or commas.

| Tip
| Each section may occur multiple times.

| Note
| You can explicitely end the configuration file with an [EOF] (on a separate line), but this is not required, unless there is some junk beyond that may confuse the parser. A PGP signature does not qualify as 'junk' if samhain is compiled to verify the signature.

## C.1.1. Conditionals

Conditional inclusion of entries for some host(s) is supported via any number of @hostname/@end directives. @hostname and @end must each be on separate lines. Lines in between will only be read if hostname (which may be a regular expression) matches the local host.

Likewise, conditional inclusion of entries based on system type is supported via any number of $sysname:release:machine/$end directives. sysname:release:machine for the local host can be determined using the command uname -srm and may be a regular expression.

A '!' in front of the '@'/'\$' will invert its meaning. Conditionals may be nested up to 15 levels.

      @hostname
      # only read if hostname matches local host
      @end
      !@hostname
      # not read if hostname matches local host
      @end
      #
      $sysname:release:machine
      # only read if sysname:release:machine matches local host
      $end
      !$sysname:release:machine
      # not read if sysname:release:machine matches  local host
      $end

Prev | Home | Next
yule |  | Files to check