5. Excluding files and/or subdirectories (All except...)
Prev | Chapter 5. Configuring samhain, the host integrity monitor | Next

## 5. Excluding files and/or subdirectories (All except...)

To exclude individual files from a directory, place them under the policy IgnoreAll. Note that the existence of such files will still be checked (see next section).

To exclude subdirectories from a directory, place them under the policy IgnoreAll with an individual recursion depth of -1(see Section 4.5 ).

| Note

Changes in a directory may also modify the directory inode itself (i.e. the special file that holds the directory information). If you want to check all but a few files in a directory (say, `/etc`), and you expect some of the excluded files to get modified, you should use a setup like:

    	    [ReadOnly]
    	    #
    	    dir=/etc
    	    #
    	    [Attributes]
    	    #
    	    # less restrictive policy for the directory file itself
    	    #
    	    file=/etc
    	    #
    	    [IgnoreAll]
    	    #
    	    # exclude these file and directories
    	    #
    	    file=/etc/resolv.conf.save
    	    dir=-1/etc/calendar
    	    #

Prev | Up | Next
4. Defining file check policies: what, and how, to monitor | Home | 6. Timing file checks