Index: trunk/docs/FAQ.html
===================================================================
--- trunk/docs/FAQ.html (revision 462)
+++ trunk/docs/FAQ.html (revision 538)
@@ -139,5 +139,5 @@
-FAQ Revised: Wednesday 14 January 2015 20:41:15
+FAQ Revised: Monday 17 September 2018 15:13:17
Table of Contents
@@ -147,20 +147,19 @@
1.2. samhain exits with the message "Untrusted path" for config/log/pid/database files
1.3. It does not log anything / Can't stop logging to console
-1.4. Client cannot self-resolve, but nslookup works fine
-1.5. Server logs hostname instead of FQDN (or vice versa)
+1.4. samhain exits with the message "Record with bad version number in file signature database"
+1.5. Client cannot self-resolve, but nslookup works fine
+1.6. Server logs hostname instead of FQDN (or vice versa)
2. Build and install
3. File checking
@@ -282,5 +281,9 @@
is a bad idea, because samhain will open the device and write (i.e. it is
a very inefficient method).
-1.4. Client cannot self-resolve, but nslookup works fine
+1.4. samhain exits with the message "Record with bad version number in file signature database"
+This typically happens when the initialisation of the database has been
+done repeatedly, i.e. by using '-t init' multiple times, without (re)moving
+the previous database first before an initialisation.
+1.5. Client cannot self-resolve, but nslookup works fine
- Nslookup is a program to query Internet domain name servers.
@@ -333,5 +336,5 @@
xxx.xxx.xxx.xxx myhost.mydomain.tld myhost
-1.5. Server logs hostname instead of FQDN (or vice versa)
+1.6. Server logs hostname instead of FQDN (or vice versa)
The default is to log the hostname only, if you want the FQDN
then there is an option for the server configuration:
@@ -343,13 +346,5 @@
2. Build and install
-- 2.1. [Fedora Core] Cannot compile with --enable-khide
-- The Fedora Core kernel is patched to unconditionally deny reading
-from /dev/kmem. Compiling the stealth kernel modules is not possible
-under these circumstances.
-- 2.2. [Fedora Core] Cannot compile with --with-kcheck
-- The Fedora Core kernel is patched to unconditionally deny reading
-from /dev/kmem. Checking the kernel for the presence of rootkits is
-not possible under these circumstances.
-- 2.3. "make" loops infinitely !
+- 2.1. "make" loops infinitely !
- This may happen (e.g. when building via NFS for multiple architectures)
if the relative timestamps in the source directory are
@@ -358,9 +353,9 @@
"touch * && make distclean" in the source directory
to recover.
-- 2.4. Why does static compiling (
--enable-static) on Solaris fail ?
+- 2.2. Why does static compiling (
--enable-static) on Solaris fail ?
- Ingo Rogalsky has provided the following information: It isn't possible
to link Samhain statically with Solaris. This
is a Solaris issue (see Sun Infodoc ID12624) and not a samhain problem.
-- 2.5. Compilation fails with '/usr/bin/ld: cannot find -lnss_files'
+- 2.3. Compilation fails with '/usr/bin/ld: cannot find -lnss_files'
- For Linux, this is a known problem with --enable-static if you compile
in MySQL support. The problem is that the
@@ -378,5 +373,5 @@
client_libs variable, and remove all instances
of -lnss_files and -lnss_dns.
-- 2.6. The executable is corrupted after installation
+- 2.4. The executable is corrupted after installation
- The executable will get stripped during the installation. On
suitable systems (i386 Linux/FreeBSD currently), additionally
@@ -388,12 +383,12 @@
executable, therefore trying to strip manually after installation
will corrupt the executable.
-- 2.7. --enable-xml-log has no effect
+- 2.5. --enable-xml-log has no effect
- If you have compiled for stealth, you won't see much, because if
obfuscated, then both a 'normal' and an XML logfile look,
well ... obfuscated. Use
samhain -jL /path/to/logfile
to view the logfile.
-- 2.8. ./install-sh: strip: not found (Solaris)
+- 2.6. ./install-sh: strip: not found (Solaris)
- Install the SUNWbtool package.
-- 2.9. What is sh_tiger1.s?
+- 2.7. What is sh_tiger1.s?
- This is a precompiled assembly file for the i386 architecture
generated from sh_tiger1.c using gcc 3.4.0 with the following options,
@@ -411,9 +406,9 @@
it would be impossible to maintain a library of optimal compile options
for every version of gcc.
-- 2.10. Why does static compiling (
--enable-static) on MaxOS X fail ?
+- 2.8. Why does static compiling (
--enable-static) on MaxOS X fail ?
- Static linking is not supported on MacOS X, see
Technical Q&A QA1118.
This is a MacOS X issue and not a bug in samhain.
-- 2.11. Why does compiling with MySQL fail on Solaris ?
+- 2.9. Why does compiling with MySQL fail on Solaris ?
- The reason is often the shell script 'mysql_config' that comes as part
of MySQL. This script is intended to print appropriate compiler flags for