On-demand File Integrity Monitoring settings

The table describes all available values and default values of all the settings that you can specify for the On-demand File Integrity Monitoring task.

On-demand File Integrity Monitoring settings

Setting

Description

Values

RebuildBaseline

Enables rebuilding a baseline after the ODFIM task has finished.

Yes — Rebuild a baseline after the ODFIM task has finished.

No (default value) — Do not rebuild a baseline after the ODFIM task has finished.

CheckFileHash

Enables hash check (SHA-256).

Yes — Enable hash check.

No (default value) — Disable hash check. If this check is disabled, the application compares only the file size (if the file size has not changed, then the modification time is not considered a critical parameter).

TrackDirectoryChanges

Enables directory monitoring.

Yes — Monitor directories.

No (default value) — Do not monitor directories.

TrackLastAccessTime

Enables tracking last file access time. In the Linux operating systems it is the noatime setting.

Yes — Track last file access time.

No (default value) — Do not track last file access time.

UseExcludeMasks

Enables monitoring scope exclusions for objects specified by the ExcludeMasks.item_# setting.

This setting only applies if a value is specified for the ExcludeMasks.item_# setting.

Yes — Exclude objects specified by the ExcludeMasks.item_# setting from the monitoring scope.

No (default value) — Do not exclude objects specified by the ExcludeMasks.item_# setting from the monitoring scope.

ExcludeMasks.item_#

Excludes objects from monitoring by names or masks. You can use this setting to exclude an individual file from the specified scan scope by name or exclude several files at once using masks in the shell format.

Before specifying a value for this setting, make sure that the UseExcludeMasks setting is enabled.

You can specify several masks. Each mask must be specified on a new line with a new index.

The default value is not defined.

The [ScanScope.item_#] section contains the monitoring scopes of the System Integrity Monitoring task. At least one monitoring scope must be specified for the task. You can specify several [ScanScope.item_#] sections in any order. The application processes the scopes by index in ascending order.

The [ScanScope.item_#] section contains the following settings:

AreaDesc

Description of monitoring scope; contains additional information about the monitoring scope.

The default value is not defined.

UseScanArea

Enables monitoring of the specified scope.

Yes (default value) — Monitor the specified scope.

No — Do not monitor the specified scope.

Path

Path to the monitoring directory.

You can use masks to specify the path.

Default value: /opt/kaspersky/kesl/

AreaMask.item_#

Monitoring scope limitation. Within the monitoring scope, the application scans only the objects that are specified using the masks in the shell format.

You can specify several AreaMask.item_# items in any order. The application processes the scopes by index in ascending order.

Default value: * (all objects are monitored)

The [ExcludedFromScanScope.item_#] section contains the objects to be excluded from all [ScanScope.item_#] sections. The objects that match the rules of any [ExcludedFromScanScope.item_#] section will be excluded from monitoring. The format of the [ExcludedFromScanScope.item_#] section is similar to the format of the [ScanScope.item_#] section. You can specify several [ExcludedFromScanScope.item_#] sections in any order. The application processes the scopes by index in ascending order.

The [ExcludedFromScanScope.item_#] section contains the following settings:

AreaDesc

Description of the monitoring exclusion scope, which contains additional information about the monitoring exclusion scope.

The default value is not defined.

UseScanArea

Excludes the specified scope from monitoring.

Yes (default value) — Exclude the specified scope from monitoring.

No — Do not exclude the specified scope from monitoring.

Path

Path to the directory with objects excluded from monitoring.

You can use masks to specify the path.

The default value is not defined.

AreaMask.item_#

Limitation of monitoring exclusion scope. In the monitoring exclusion scope, the application only excludes the objects that are specified using masks in the shell format.

You can specify several AreaMask.item_# items in any order. The application processes the scopes by index in ascending order.

Default value: * (exclude all objects from monitoring)

Page top