I am using Linux Malware Detect to scan and report on malware, but on a daily basis I receive alerts for malware in users emails (mainly spam folder). I do not want alerts for this, the spam folders are cleaned often, and the users may clean it also.

I tried adding wildcards into /usr/local/maldetect/ignore_paths as follows but they are not ignored:


Does anyone know how to exclude folders using wildcards, as it would not be practical to add the full path of every users mail directory.



I have found only

A line spaced file for regexp paths that are excluded from inotify monitoring
Sample ignore entry:


If you monitor files with inotify(flag -m) then it can help you.

Based on this code of maldet:

 if [ "$days" == "all" ]; then
  if [ -z "$setmodsec" ]; then
          eout "{scan} building file list for $spath, this might take awhile..." 1
  $find $spath $tmpdir_paths -maxdepth $maxdepth -type f -size +${minfilesize}c -size -$maxfilesize $ignore_fext | grep -vf $ignore_paths > $find_results
  if [ -z "$setmodsec" ]; then
          eout "{scan} building file list for $spath of new/modified files from last $days days, this might take awhile..." 1
  $find $spath $tmpdir_paths -maxdepth $maxdepth -type f -mtime -$days -size +${minfilesize}c -size -$maxfilesize $ignore_fext | grep -vf $ignore_paths > $find_results

I can say that you can use same wildcards as you do usually in grep.

However i have tested it on my version of maldet and it works only if i specified it like this:


Try use dots in your path expressions.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.