chkrootkit config file options

I have installed the chkrootkit package with sudo apt-get install chkrootkit. When going to the /etc/chkrootkit.conf config file I see the following options:


I assume that the RUN_DAILY option if enabled would get chkrootkit to run an automated scan daily, and that the RUN_DAILY_OPTS sets what kind of scan the daily scan is in terms of which option it is using. Am I correct here? And if so then these automated scans, where are the results logged and how often do these scans occur?

Also, what does the DIFF_MODE option do? And should I enable it?

I have read the README file here and found nothing to do with this config file.

Asked By: user364819


If “yes” it runs daily automatically, it “no” you need to run it manually. Als have a look at /etc/cron.daily/chkrootkit. Here you can add something like it sending the report to an e-mail address.


These are options you can include. -q means quiet so it does not print anything on screen when running.


If this is set to “yes” chrootkit compares the files /var/log/chkrootkit/log.expected with /var/log/chkrootkit/

Have a look at /etc/cron.daily/chkrootkit and $CHKROOTKIT $RUN_DAILY_OPTS. You can expand this with a | mail -s $HOSTNAME $YOUR_EMAIL_ADDRESS (untested!) to have it send mails after the scan is done.

Answered By: Rinzwind

Had to google around to get all this info…

edit /etc/cron.daily/chkrootkit

#        eval $CHKROOTKIT $RUN_DAILY_OPTS | (egrep -v -f "${IGNORE_FILE}" || true)
$CHKROOTKIT > $LOG_DIR/chkrootkit.log #Run chkrootkit and save the logfile
echo "Subject: [chkrootkit] $(hostname -f) - Daily report" #Create subject line using the hostname
echo "To: $REPORT_EMAIL" #Insert To: delivery email address using the variable defined in chkrootkit.conf
echo ""
cat $LOG_DIR/chkrootkit.log #Concat the logfile to the output
) | /usr/sbin/sendmail $REPORT_EMAIL #Send out the email!

edit /etc/chkrootkit.conf


edit/create /etc/logrotate.d/chkroot

/var/log/chkrootkit/*.log {
  rotate 15

run chkrootkit to generate a baseline


Copy the existing log to the log expected file

cp /var/log/chkrootkit/chkrootkit.log /var/log/chkrootkit/log.expected

Should be good to go.

Answered By: Silky Sandpaper
Categories: Answers Tags: ,
Answers are sorted by their score. The answer accepted by the question owner as the best is marked with
at the top-right corner.