Home / server / Questions / 813240
Accepted
Juan Jimenez
Asked: 2016-11-05 07:25:19 +0800 CST

chkrootkit on cron but report only if it detects a positive (false or not)

  • 772

I would like to create a cron job that runs chkrootkit, but only emails me the resulting log if there is a positive, false or not. The chkrootkit faq gives this as a suggestion:

0 3 * * * (cd /path/to/chkrootkit; ./chkrootkit 2>&1 | mail -s "chkrootkit output" root)

...but I run an HPC cluster with over 100 nodes. I only want it to mail the log if it has detected something to which I should pay attention.

How should I go about doing this?

cron

1 Answers

  1. Best Answer

    From the README:

    1. Output Messages

      The following messages are printed by chkrootkit (except with the -x and -q command options) during its tests:

      "INFECTED": the test has identified a command probably modified by a known rootkit;
      ...

    So write little script that runs chkrootkit and redirects the output to a temp file, parse the temp file for the string "INFECTED" and if found; send an email with the relevant info to identify the host and add that temp file as an attachment, delete temp file.

    • 0