etc/templates/config/rootcheck.template

   1   <rootcheck>
   2     <!-- Frequency that rootcheck is executed - every 10 hours -->
   3     <frequency>36000</frequency>
   4
   5     <!-- Local of the rootkit_files and rootkit_trojans files -->
   6     <rootkit_files>/var/ossec/etc/shared/rootkit_files.txt</rootkit_files>
   7     <rootkit_trojans>/var/ossec/etc/shared/rootkit_trojans.txt</rootkit_trojans>
   8     <system_audit>/var/ossec/etc/shared/system_audit_rcl.txt</system_audit>
   9     <system_audit>/var/ossec/etc/shared/cis_rhel5_linux_rcl.txt</system_audit>
  10     <system_audit>/var/ossec/etc/shared/cis_rhel6_linux_rcl.txt</system_audit>
  11     <system_audit>/var/ossec/etc/shared/cis_rhel7_linux_rcl.txt</system_audit>
  12     <system_audit>/var/ossec/etc/shared/cis_debian_linux_rcl.txt</system_audit>
  13     <system_audit>/var/ossec/etc/shared/cis_rhel_linux_rcl.txt</system_audit>
  14     <system_audit>/var/ossec/etc/shared/cis_sles11_linux_rcl.txt</system_audit>
  15     <system_audit>/var/ossec/etc/shared/cis_sles12_linux_rcl.txt</system_audit>
  16     <system_audit>/var/ossec/etc/shared/system_audit_ssh.txt</system_audit>
  17
  18   </rootcheck>