I have found only
/usr/local/maldetect/ignore_inotify
A line spaced file for regexp paths that are excluded from inotify monitoring
Sample ignore entry:
^/home/user$
^/var/tmp/#sql_.*\.MYD$
http://www.rfxn.com/appdocs/README.maldetect
If you monitor files with inotify(flag -m) then it can help you.
Based on this code of maldet:
if [ "$days" == "all" ]; then
if [ -z "$setmodsec" ]; then
eout "{scan} building file list for $spath, this might take awhile..." 1
fi
$find $spath $tmpdir_paths -maxdepth $maxdepth -type f -size +${minfilesize}c -size -$maxfilesize $ignore_fext | grep -vf $ignore_paths > $find_results
else
if [ -z "$setmodsec" ]; then
eout "{scan} building file list for $spath of new/modified files from last $days days, this might take awhile..." 1
fi
$find $spath $tmpdir_paths -maxdepth $maxdepth -type f -mtime -$days -size +${minfilesize}c -size -$maxfilesize $ignore_fext | grep -vf $ignore_paths > $find_results
fi
I can say that you can use same wildcards as you do usually in grep.
However i have tested it on my version of maldet and it works only if i specified it like this:
/home/.*/homes/.*/Maildir
Try use dots in your path expressions.