@c -*-texinfo-*-
@c This is part of the Integrit File Verification System Manual.
@c Copyright (C) 2006 Ed L. Cashin
@c See the file integrit.texi for copying conditions.
@setfilename ../info/faq

@c Copyright (C) 2006 Ed L. Cashin
@c 
@c This program is free software; you can redistribute it and/or
@c modify it under the terms of the GNU General Public License
@c as published by the Free Software Foundation; either version 2
@c of the License, or (at your option) any later version.
@c 
@c This program is distributed in the hope that it will be useful,
@c but WITHOUT ANY WARRANTY; without even the implied warranty of
@c MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
@c GNU General Public License for more details.
@c 
@c You should have received a copy of the GNU General Public License
@c along with this program; if not, write to the Free Software
@c Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
@c 

@comment  node-name,  next,  previous,  up
@node FAQ, Resources, Auxiliary Tools, Top
@chapter FAQ
@cindex FAQ

@menu
* Win32::                  What about Win32 support?
* Regular Expressions::    What about regular expressions in the conf file?
* Trailing Slash::         Why doesn't "! /proc/" work?
@c * MD5 Sum Changes::        The MD5 sum is different everytime I do an update!
@c * Failing opendir::        Why doesn't integrit keep running when it can't open a directory?
* Missing Files::          I don't see missing files when doing a check!
* Large Files::            It crashes on encountering large (> 5 Gig) files!
* Multiple Roots::         I want to put multiple roots in one config file!
@end menu

@node Win32
@section Win32
@cindex Windows

Q: What about Win32 support?

A few people have asked about Win32 support.  In short, go for it.  I
get the impression that it's not something that a lot of people have
done, and I'm not much of a Windows user, but I did it just to see
what would happen.

A helpful soul pointed out that it is still (Windows 2000) not
possible to create a directory named "aux" in Windows (a DOS-ism like
"prn" and "nul"), and so integrit's aux directory has been renamed to
"utils" since version three to accomodate the limitation.  Since then
it's been theoretically possible to build integrit on Windows.

Version 3.03 integrit on Windows XP using Cygwin 1.3.12-2 builds
cleanly and passes the ``make test''.  Your mileage may vary.

@node Regular Expressions
@section Regular Expressions
@cindex Regular Expressions

Q: What about regular expressions in the conf file?

It usually occurs to an integrit user at some point, "Wouldn't it be
nice to use regular expressions in the integrit configuration file
instead of literal paths?"  The answer is that, yes, that would be
convenient, but it isn't likely to happen.

The added runtime cost of compiling regular expression objects and
evaluating all the pathnames would be substantial, and it would make
integrit more complex.  Better to leave integrit stable and simple and
then list files explicitly in the configuration file.  

After all, you have all kinds of unix tools (find, grep, etc.), that can
help you create the configuration file by using regular expressions!

@c @node Failing opendir
@c @section Failing opendir
@c @cindex Failing opendir
@c 

@node Trailing Slash
@section Trailing Slash
@cindex Trailing Slash

Q: Why does integrit scan /proc when I put "! /proc/" in the
configuration file? 

Trailing slashes aren't really part of a directory's name.  Leave them
out in the configuration file.

For example, to ignore @code{/var/tmp}, this will work:

@example
    ! /tmp
@end example

... but this will not:

@example
    # WRONG: trailing slash
    ! /tmp/
@end example

@c @node MD5 Sum Changes
@c @section MD5 Sum Changes
@c @cindex MD5 Sum Changes
@c 
@c Q: Why does the MD5 sum change everytime I do an update?
@c 
@c To be specific, the MD5 sum is a checksum of the @emph{current} (or new)
@c database.  It will be different everytime you tell integrit to update
@c the current database with the @code{-u} option.  Here's why @dots{}
@c 
@c For each file integrit visits, there's a record in the current database,
@c and part of each record is a file stat structure.  You can see what's in
@c that structure by reading your system's @code{stat(2)} manpage.  
@c 
@c The file stat structure contains both the file's access time and the
@c "change time".  The change time is updated whenever the information
@c associated with the inode is changed.  For example, if you tell integrit
@c to reset the file's access time after integrit reads the contents of the
@c file to do a checksum, then that means that the change time for the file
@c will change 

@node Missing Files
@section Missing Files
@cindex Missing Files

Q: When I do a check only, -c and no -u, I get an error:

@example
   integrit: not doing update, so no check for missing files
@end example

Just use both "-c" and "-u".  This is the fastest, simplest way to be
able to check for missing files.  If integrit is creating a new
current-state database, then at the end of the run it has all the
information it needs to tell you what files are missing.

The good news is that it takes almost the same amount of time to do
check and update simultaneously as it would to do one or the other.
wouldn't be gaining anything by running check by itself.

@node Large Files
@section Large Files
@cindex Large File Support

Q: Why does integrit crash on encountering files of greater than five
gigabytes in size?

It's a platform-dependent thing.  

Many Operating Systems are in the process of developing support for
large files.  If you see integrit fail when it encounters large files,
then large file support is what you need.  

Since version 3.02, integrit has large file support turned on by
default (via the autoconf-generated configure script), but you still
need to make sure your system can handle large files.

For Linux-based systems, there is a good document here:

  http://www.suse.de/~aj/linux_lfs.html

In a nutshell, if you are using gcc and Linux, then if your using a
2.4.x and an ext2 filesystem that was created under a 2.4.x kernel,
then you should be OK with integrit versions 3.02 and later.

For general information, here is a resource:

  http://www.sas.com/standards/large.file/x_open.20Mar96.html

Your system should have documentation explaining how to get large file
support.

@node Multiple Roots
@section Multiple Roots
@cindex Multiple Roots

Q: Wouldn't it be nicer if we could put multiple roots in one integrit
config file?

A: Perhaps, but not much nicer, and it would complicate integrit
internally. 

Say you want to ignore all of /usr/local in your integrit-root.conf
configuration file, but you want to check /usr/local/etc.  You can
create another configuration file, integrit-usr_local_etc.conf, with
``root=/usr/local/etc'' in it.  

Then simply run integrit twice.  You can even run two integrits in
parallel if /usr/local/etc is on a different device than the other
areas and you have the CPU and memory to spare.

It is very easy to generate multiple configuration files from a master
configuration file using UN*X tools.  It's also easy to create a
statically-linked program that does fork and execl to run multiple
integrits.  There's an example in the examples directory of the
integrit distribution: integrit-run.c.


