linux-malware-detect icon indicating copy to clipboard operation
linux-malware-detect copied to clipboard

Not getting email alerts in monitor mode

Open skidvd opened this issue 1 year ago • 1 comments

I have installed and configured Maldet and clamAV on my Ubuntu 22 system.

My /usr/local/maldetect/conf.maldet contains the following key items:

email_alert="1" email_addr="" email_ignore_clean="0" scan_clamscan="1" default_monitor_mode="/usr/local/maldetect/monitor_paths"

I also have postfix successfully working on this box.

If I run a manual scan as follows:

maldet --scan-all /tmp

And then review and email the report as follows:

maldet --report 231009-0926.410115

I then receive the expected report in email.

However, I am not receiving any of the expected daily emails or any other emails from maldet whatsoever? I have manually run both:

maldet --monitor-report and /etc/cron.daily/maldet

Both of the above succeed and do not produce any errors, but I still receive no email in response to them.

What am I missing or doing incorrectly please?

skidvd avatar Oct 09 '23 15:10 skidvd

In my searching, I have discovered this post: https://serverfault.com/questions/805158/how-to-get-an-email-report-of-whatever-the-most-recent-maldet-scan-is

It suggests adding something like this https://github.com/kdubdev/linux-malware-detect/blob/master/files/cron/custom.cron into maldet's custom.cron file.

I tried it and it does indeed result in a daily email of the 'latest' scan results.

However, I am confused as I would have thought the standard madlet.conf email_alert="1" and related settings shown in my original post should have done the very same thing. Is this really necessary? What am I missing?

skidvd avatar Oct 10 '23 14:10 skidvd