Knowledgebase

1. Double check that the default_monitor_mode is set:

Edit /usr/local/maldetect/conf.maldet and find and set:

default_monitor_mode="users"

2. Some users may also need to increase their inotify file watch limit on their systems before the maldet monitoring daemon will start.

To view your current limit:

cat /proc/sys/fs/inotify/max_user_watches

To raise your limit:

echo fs.inotify.max_user_watches=1048576 > /etc/sysctl.d/sentinel.conf
sysctl -p /etc/sysctl.d/sentinel.conf

Start the service:

systemctl restart maldet

Check the logs for any errors:

tail -f /usr/local/maldetect/logs/event_log  

Example error of when max_user_watches is too low:

Please increase the amount of inotify watches allowed per user via `/proc/sys/fs/inotify/max_user_watches'.