Checking for hidden/fake/required processes

Samhain
Prev | Appendix C. List of configuration file options | Next

# C.10. Checking for hidden/fake/required processes

Section heading:

[ProcessCheck]

Entries:

ProcessCheckActive=`boolean` — 'true' to switch on, 'false' to switch off.

SeverityProcessCheck=`severity` — Severity for events (default is crit).

ProcessCheckMinPID=`integer` — Minimum PID (default is 0).

ProcessCheckMaxPID=`integer` — Maximum PID (default is 32767).

ProcessCheckInterval=`seconds` — Interval between checks.

ProcessCheckExists=`POSIX regular expression` — A process that is required to run. Must match a substring in a line of the 'ps' output.

ProcessCheckPSPath=`path` — The path to ps (default: autodetected at compile time).

ProcessCheckPSArg=`path` — The argument to ps (default: autodetected at compile time). Note that the first column must be the PID, except on Linux, where the format 'PID SPID ...' is expected (spid = thread id), as shown by 'ps -eT'.

Prev | Home | Next
Checking for user files | Up | Checking for open ports