You may define as many directory blocks as you need. Previous versions of nabou had some predefined default checks turned on in case your directory block looked like this one:

 <directory /etc>
 </directory> 

Today it will not do any checks on a dir unless you tell it what to check. it is also possible to define "recursive 1" and nothing more, then it will tell you about added or removed files recursively under that dir, but it will not do any check on any file.

These are the options you may define:

recursive

If turned on, then nabou will also check all files in subdirectories under that directory. The default is 0(off).

exclude

you may specify a filename which nabou shall ignore. You may specify multiple exclude lines one for one file. You may use shell-wildcards for filenames. An example:

 <directory /dev>
   exclude tt*
   exclude pt*
 </directory> 

If you want to ignore files under a subdirectory, then you are required to specify this file/dir relative to the directoy block. An example:

 <dir /usr/local>
   exclude share/blackbox/*
 </directory> 

In the example below, /usr/local/share/blackbox/* will be ignored. The exclude attribute cannot used together with the include attriute (see above).

If you need more than a few files to be excluded you might consider using an exclude block as the better way of doing such. An example:

 <directory chk_logdir>
       recursive        1
       chk_mode         1
       chk_uid          1
       chk_gid          1
       du_increase	30
       <exclude>
                /var/log/XFree86.0.log
       		/var/log/boot.log
       		/var/log/dmesg
       		/var/log/xdm-errors
       		/var/log/xfs.errors
       </exclude>
 </directory> 

include

You may specify one or more include lines. If an include attribute occurs within a directory block (or more than one), then nabou will only look for the file(s) specified by include. It will ignore all other files under that directory! You cannot use shell-wildcards with the include- attribute! An example:

 <directory /home/vasall>
   include .history
   include todo
 </directory> 

The include attribute cannot be used together with the exclude attribute.

The include statement does not a block notation as the exclude statement does!

du_decrease

A percent value, the default is 10%. This will only be used if you turn check_diskusage on. nabou will print a message if the diskusage of a monitored directory decreases under the specified minimum percentage.

Excluded files will not counted. If you use one or more include statements, then only the diskusage of these files will be counted.

du_increase

A percent value too, like the one above. You will get a message if the diskusage of a monitored directory increases over the specified maximum percentage.

inherit

This is a very special attribute. It takes a directory name as argument, which must be defined as a directory block somewhere in the configuration. It causes the directory to inherit all attributes defined from the specified directory block. Please note, that you cannot specify additional attributes if you are using inherit, because all attributes are used from the inheritted block! An example:

 <directory /bin>
   chk_md5	 	1
   recursive	1
 </directory>
 <directory /sbin>
   inherit		/bin
 </directory> 

In this example, nabou will do an md5-checksum lookup and do a recursive lookup for the directory /sbin. If the inherit attribute refers to a directory, which is not defined within the configuration, then nabou will warn you about this and use the default attributes chk_md5=1 and recursive=0.

You can specify one or more file attributes nabou shall look for:

chk_md5

this option exists for backward compatibility. See chk_hash.

chk_hash

check for changes on checksums. It does hash digest checksum testing depending on your use_algo setting.

chk_size

check for changes on the file size.

chk_shrink

check for file size shrink.

chk_grow

check for file size grow.

chk_mtime

check for changes of the modification time.

chk_uid

check if owner of the files has changed.

chk_gid

check if group of the files has changed.

chk_nlinks

check if the number of links to a file has changed.

chk_mode

check if the mode of files has changed.

chk_ino

check if the filesystem inode has changed.

The attributes above will be used, if you turn on chk_all! The followng attributes can also be checked:

chk_dev

the device number of the filesystem

chk_ctime

inode change time

chk_blocks

the number of blocks allocated on a filesystem.

chk_custom

see the section CUSTOM SCRIPTLETS below!

The following file attributes cannot be checked with nabou:

access time: that's senceless, because, the accesstime changes when nabou calls stat(2) on a file! And the attributes rdev and blcksize. See stat? for details or look at the file dbformat.txt shipped with the nabou tarball.

DEFINE AND CHECK BLOCKS

If you need to define many different files/directories in your config you will soon find it boring to write a complete directory block for each single directory/file.

For that reason a new feature exists, which allows you to define check templates. Once you have defined such a template you can apply it to many directories/files within one check block.

DEFINE BLOCKS

Sample:

 <define chk_logfile>
       chk_shrink       1
       chk_mode         1
       chk_uid          1
       chk_gid          1
 </define> 

This defines a new check template called chk_logfile (you can choose any name you like). This particular template is used to check mode/uid/gid bits and to check if a file shrinks, which is generally not good with logfiles.

You are allowed to use any possible check statement and option which is available for directory blocks too.

One thing is important: if you want to use the exclude or include statement inside a define block, then you must specify the absolute pathname, relative pathnames are not allowed (or: they will not work as you expect!) inside define blocks.

CHECK BLOCKS

Now that we have defined our own check template, we want to apply it to some file within one block:

 <check chk_logfile>
       /var/log/messages
       /var/log/wtmp
       /var/log/faillog
       /var/log/lastlog
       /var/log/kernel
       /var/log/firewall
       /var/log/secure
 </check> 

That's it.

INCLUDE EXTERNAL FILES

There is a very special and useful parameter which allows you include another file:

<>>

 --- mail.rc ---
 <mail>
	rcpt	tom@daemon.de 
	from	root@localhost
	subject	nabou report
 </mail>
 --- end --- 

 --- nabou.rc ---
 <<include mail.rc>>
 ...
 --- end ---