Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Not getting email alerts in monitor mode #424

Open
skidvd opened this issue Oct 9, 2023 · 1 comment
Open

Not getting email alerts in monitor mode #424

skidvd opened this issue Oct 9, 2023 · 1 comment

Comments

@skidvd
Copy link

skidvd commented Oct 9, 2023

I have installed and configured Maldet and clamAV on my Ubuntu 22 system.

My /usr/local/maldetect/conf.maldet contains the following key items:

email_alert="1"
email_addr=""
email_ignore_clean="0"
scan_clamscan="1"
default_monitor_mode="/usr/local/maldetect/monitor_paths"

I also have postfix successfully working on this box.

If I run a manual scan as follows:

maldet --scan-all /tmp

And then review and email the report as follows:

maldet --report 231009-0926.410115

I then receive the expected report in email.

However, I am not receiving any of the expected daily emails or any other emails from maldet whatsoever? I have manually run both:

maldet --monitor-report
and
/etc/cron.daily/maldet

Both of the above succeed and do not produce any errors, but I still receive no email in response to them.

What am I missing or doing incorrectly please?

@skidvd
Copy link
Author

skidvd commented Oct 10, 2023

In my searching, I have discovered this post: https://serverfault.com/questions/805158/how-to-get-an-email-report-of-whatever-the-most-recent-maldet-scan-is

It suggests adding something like this https://github.com/kdubdev/linux-malware-detect/blob/master/files/cron/custom.cron into maldet's custom.cron file.

I tried it and it does indeed result in a daily email of the 'latest' scan results.

However, I am confused as I would have thought the standard madlet.conf email_alert="1" and related settings shown in my original post should have done the very same thing. Is this really necessary? What am I missing?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant