Chapter 7. Hooks for External Programs

samhain provides several hooks for external programs for (re-)processing the audit trail, including pipes, a System V message queue, and the option to call external programs.

7.1. Pipes

It is possible to use named pipes as 'console' device(s) (samhain supports up to two console devices, both of which may be named pipes. You can set the device path at compile time (see Section A.5>), and/or in the configuration file (see Section 4.8>).