etc/templates/config/rootcheck.template

   1   <rootcheck>
   2     <!-- Frequency that rootcheck is executed - every 10 hours -->
   3     <frequency>36000</frequency>
   4
   5     <!-- Local of the rootkit_files and rootkit_trojans files -->
   6     <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
   7     <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
   8     <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
   9   </rootcheck>