[cobalt-users] chkrootkit

["Gavin Nelmes-Crocker" <cobalt@xxxxxxxxxxxxxxxx>]

I'm doing a pkg including chkrootkit-0.39a at the moment and am planning to
add in a script for running it every day and mailing it etc.

I want to try and make the email easier to see if you have a problem or not
as there is a tendency if you have several servers to end up getting 6 mails
a morning for chkrootkit,backup etc and just glancing at them and possibly
missing a problem.  Does anyone see a problem with doing a grep -v not to
remove the following

not infected, nothing deleted, nothing detected etc

The problem is I only have clean boxes I'm testing on, I don't want to find
I clear a line for an infected box - If anyone has a copy of an infected
report I can test with that would be great just send it to
developers@xxxxxxxxxxxxxxx not to the list please.

Of course if anyone has already done a script for themselves that does this
and wants to share it for the greater good drop it over to me - as always
full credit given.

Thanks

Regards

Gavin