ossec.conf: Rootcheck options¶

Overview¶

<ossec_config>
    <rootcheck>
        <!--
        rootcheck options here
        -->
    </rootcheck>
</ossec_config>

<agent_config>
    <rootcheck>
        <!--
        rootcheck options here
        -->
    </rootcheck>
</agent_config>

Options¶

base_directory¶

The base directory that will be appended to the following options:

• rootkit_files
• rootkit_trojans
• windows_malware
• windows_audit
• windows_apps
• systems_audit

Allowed: Path to a directory Default: /var/ossec

rootkit_files¶

This option can be used to change the location of the rootkit files database.

Allowed: A file with the rootkit files signatures

Default: /etc/shared/rootkit_files.txt

rootkit_trojans¶

This option can be used to change the location of the rootkit trojans database.

Default: /etc/shared/rootkit_trojans.txt

Allowed: A file with the trojans signatures

windows_audit¶

system_audit¶

windows_apps¶

windows_malware¶

scanall¶

Tells rootcheck to scan the whole system (may lead to some false positives).

Default: no

Allowed: yes/no

frequency¶

Frequency that the rootcheck is going to be executed (in seconds).

Defaults: 36000 (10 hours)

Allowed: Time (in seconds)

disabled¶

Disables the execution of rootcheck.

Default: no

Allowed: yes/no

check_dev¶

Enable or disable the checking for files in the `/dev` filesystem

Default: yes

Allowed: yes or no

check_files¶

Enable or disable the checking based on the rootkit files

Default: yes

Allowed: yes or no

check_if¶

Enable or disable the checking the network interfaces

Default: yes

Allowed: yes or no

check_pids¶

Enable or disable the checking of process IDs

Default: yes

Allowed: yes or no

check_ports¶

Enable or disable the checking of network ports.

Default: yes

Allowed: yes or no

check_sys¶

Enable or disable the checking the filesystem looking for possible issues

Default: yes

Allowed: yes or no

check_trojans¶

Enable or disable the checking of trojans.

Default: yes

Allowed: yes or no

check_unixaudit¶

Enable or disable the checking of unix issues

Default: yes

Allowed: yes or no

check_winapps¶

Enable or disable the checking of Windows apps

Default: yes

Allowed: yes or no

check_winaudit¶

Enable or disable the checking of Windows issues

Default: 1

Allowed: 1 or 0

check_winmalware¶

Enable or disable the checking of Windows malware.

Default: yes

Allowed: yes or no

skip_nfs¶

New in version 2.9.0.

Specifies if rootcheck should scan network mounted filesystems. Works on Linux and FreeBSD. Currently skip_nfs will abort checks running against CIFS or NFS mounts.

Default: no

Allowed: yes/no

Note

This option was added in OSSEC 2.9.0.