Samhain

File Integrity Monitoring Software

LinuxmacOSSelf-hostedWindows

6.7#20 of 28

Overview

Samhain is ranked #20 of 28 in file integrity monitoring software on Specifiction. It runs on Linux, macOS, Self-hosted, Windows.

Compared on file integrity monitoring software

Free plan: Yesla-samhna.de
Deployment: on_premisesla-samhna.de
Real-time alerts: Yesla-samhna.de
Configuration monitoring: Yesla-samhna.de
Agentless monitoring: Nola-samhna.de
Supported platforms: POSIX systems including Linux, *BSD, Solaris, AIX, HP-UX, Mac OS X; Windows via Cygwinla-samhna.de

Facts

Purpose: Samhain is a file integrity and host based intrusion detection system that monitors files and logs, and detects rootkits, rogue SUID executables, open ports, and hidden processes.la-samhna.de · 4 Oct 2026
File checks: It can check file checksums and metadata including permissions, ownership, timestamps, inode, and symbolic link targets.la-samhna.de · 4 Oct 2026
Linux monitoring: On Linux, inotify can provide immediate file change notifications, and the kernel audit system can identify the login user who changed a file.la-samhna.de · 4 Oct 2026
Log monitoring: Optional log analysis supports UNIX syslog, Apache access and error logs, Samba logs, and BSD style process accounting logs.la-samhna.de · 4 Oct 2026
Integrations: Samhain can function as a Prelude sensor, includes a Nagios plugin, and can send messages to named pipes, System V message queues, and external programs.la-samhna.de · 4 Oct 2026
Database support: The fact sheet lists Oracle, MySQL, and PostgreSQL for storing client reports; it says a database is needed for the Beltane console.la-samhna.de · 4 Oct 2026
Management console: Beltane is a separate web based PHP console for viewing client reports and updating baseline databases; it requires a Samhain client/server installation and SQL logging.la-samhna.de · 4 Oct 2026
Tamper resistance: The project describes signed configuration and database files, signed reports, encrypted messages to the central log server, and stealth options.la-samhna.de · 4 Oct 2026
License: Samhain is distributed under the GNU General Public Licence.la-samhna.de · 4 Oct 2026
Latest listed release: The download page lists version 4.5.3, released October 31, 2025, and provides a SHA-256 checksum and PGP signature verification instructions.la-samhna.de · 4 Oct 2026
Documentation and support: The project provides a user manual, FAQ, HOWTOs, user forum, and a support contact address.la-samhna.de · 4 Oct 2026
Project publisher: The legal notice names WEP e.V., Samhain Labs department, as the editorial responsibility and lists Dr. Rainer Wichmann in Lüneburg, Germany.la-samhna.de · 4 Oct 2026
File integrity: It can check file checksums and attributes including size, permissions, ownership, timestamps, inode, and symbolic link targets.la-samhna.de · 4 Oct 2026
Monitoring: Optional checks cover log formats including UNIX syslog and Apache logs, Windows registry keys under Cygwin, SUID/SGID files, open ports, hidden or fake processes, mounted filesystems, and login events.la-samhna.de · 4 Oct 2026
Central management: The client/server system uses Yule to collect client reports, distribute baseline databases and configuration files, and track client status.la-samhna.de · 4 Oct 2026
Web console: Beltane is a separate web-based console that presents client reports and supports updating centrally stored baseline databases.la-samhna.de · 4 Oct 2026
Security: Samhain supports signed database and configuration files, signed reports, authenticated client connections, encrypted central logging, and stealth options.la-samhna.de · 4 Oct 2026
PCI DSS: The fact sheet describes incremental checks on growing log files as supporting the PCI DSS requirement to detect changes to existing log data.la-samhna.de · 4 Oct 2026
Platforms: The fact sheet lists POSIX systems including Linux, BSD, Solaris, AIX, HP-UX, and Mac OS X, plus Windows 2000/XP with POSIX emulation; Windows support is tested for the agent only, not the server.la-samhna.de · 4 Oct 2026
License and release: Samhain is distributed under the GNU General Public Licence; the download page lists version 4.5.3, released October 31, 2025.la-samhna.de · 4 Oct 2026
Support: Support options include documentation, a user forum and mailing list, bug reports by contact form or email, and an inquiry option for commercial installation or maintenance support.la-samhna.de · 4 Oct 2026
Notable limit: The fact sheet says Windows/Cygwin support is tested for the Samhain monitoring agent only, not the server.la-samhna.de · 4 Oct 2026