FAQ
***

Win32
=====

Q: What about Win32 support?

A few people have asked about Win32 support.  In short, go for it.  I get the impression that it's not something that a lot of people have done, and I'm not much of a Windows user, but I did it just to see what would happen.

A helpful soul pointed out that it is still (Windows 2000) not possible to create a directory named "aux" in Windows (a DOS-ism like "prn" and "nul"), and so integrit's aux directory has been renamed to "utils" since version three to accomodate the limitation.  Since then it's been theoretically possible to build integrit on Windows.

Version 3.03 integrit on Windows XP using Cygwin 1.3.12-2 builds cleanly and passes the ``make test''.  Your mileage may vary.

Regular Expressions
===================

Q: What about regular expressions in the conf file?

It usually occurs to an integrit user at some point, "Wouldn't it be nice to use regular expressions in the integrit configuration file instead of literal paths?"  The answer is that, yes, that would be convenient, but it isn't likely to happen.

The added runtime cost of compiling regular expression objects and evaluating all the pathnames would be substantial, and it would make integrit more complex.  Better to leave integrit stable and simple and then list files explicitly in the configuration file.

After all, you have all kinds of unix tools (find, grep, etc.), that can help you create the configuration file by using regular expressions!

Trailing Slash
==============

Q: Why does integrit scan /proc when I put "! /proc/" in the configuration file?

Trailing slashes aren't really part of a directory's name.  Leave them out in the configuration file.

For example, to ignore /var/tmp, this will work:

         ! /tmp

... but this will not:

         # WRONG: trailing slash
         ! /tmp/

Missing Files
=============

Q: When I do a check only, -c and no -u, I get an error:

        integrit: not doing update, so no check for missing files

Just use both "-c" and "-u".  This is the fastest, simplest way to be able to check for missing files.  If integrit is creating a new current-state database, then at the end of the run it has all the information it needs to tell you what files are missing.

The good news is that it takes almost the same amount of time to do check and update simultaneously as it would to do one or the other. wouldn't be gaining anything by running check by itself.

Large Files
===========

Q: Why does integrit crash on encountering files of greater than five gigabytes in size?

It's a platform-dependent thing.

Many Operating Systems are in the process of developing support for large files.  If you see integrit fail when it encounters large files, then large file support is what you need.

Since version 3.02, integrit has large file support turned on by default (via the autoconf-generated configure script), but you still need to make sure your system can handle large files.

For Linux-based systems, there is a good document here:

http://www.suse.de/~aj/linux_lfs.html

In a nutshell, if you are using gcc and Linux, then if your using a 2.4.x and an ext2 filesystem that was created under a 2.4.x kernel, then you should be OK with integrit versions 3.02 and later.

For general information, here is a resource:

http://www.sas.com/standards/large.file/x_open.20Mar96.html

Your system should have documentation explaining how to get large file support.

Multiple Roots
==============

Q: Wouldn't it be nicer if we could put multiple roots in one integrit config file?

A: Perhaps, but not much nicer, and it would complicate integrit internally.

Say you want to ignore all of /usr/local in your integrit-root.conf configuration file, but you want to check /usr/local/etc.  You can create another configuration file, integrit-usr_local_etc.conf, with ``root=/usr/local/etc'' in it.

Then simply run integrit twice.  You can even run two integrits in parallel if /usr/local/etc is on a different device than the other areas and you have the CPU and memory to spare.

It is very easy to generate multiple configuration files from a master configuration file using UN*X tools.  It's also easy to create a statically-linked program that does fork and execl to run multiple integrits.  There's an example in the examples directory of the integrit distribution: integrit-run.c.