Using Samhain File Integrity Monitoring, I'm trying to monitor changes to the crontab entries. I added the below entry to /etc/samhain/samhainrc
dir=/var/spool/cron/crontabs
then I added an entry to the root account at /var/spool/cron/crontabs/root
and when I try to do Samhain -t check
, Samhain does not report the changes. It works when I try with any other file. any help?
/var/spool/cron
cron
in the question.