Samhain
Samhain is a free file-integrity and host-based intrusion detection system for monitoring files, logs, and other host activity.
What Samhain is
Samhain is a free file-integrity and host-based intrusion detection system for monitoring files, logs, and other host activity. It checks file checksums and attributes such as permissions, ownership, timestamps, inode, and symbolic-link targets, and can detect rootkits, rogue SUID executables, open ports, and hidden processes. It can run on one host or use a client/server setup: Yule collects reports, distributes baselines and configuration, and tracks client status. Optional log analysis covers formats including UNIX syslog and Apache logs. Security measures include signed configuration and reports, authenticated client connections, encrypted central logging, and stealth options. Beltane is a separate web console that requires client/server installation and SQL logging. Samhain is distributed under the GNU General Public Licence and supports Linux, macOS, Windows via Cygwin, and other POSIX systems. The listed Windows/Cygwin testing applies to the monitoring agent, not the server. The latest listed release is version 4.5.3, released October 31, 2025.
Good
- Checks file checksums and metadata.
- Can monitor one host or multiple hosts centrally.
- Optional log analysis covers UNIX syslog and Apache logs.
- Provides signed reports and encrypted central logging.
Watch out
- Windows/Cygwin testing covers the agent, not the server.
- Beltane requires client/server installation and SQL logging.
- Beltane is a separate web console.
Who it suits
Samhain may suit administrators who need file and host monitoring on one machine or across multiple hosts. Those considering Windows should note that Cygwin support is tested for the monitoring agent only, not the server.
Verdict
Samhain offers file-integrity checks and host monitoring, with centralized management available through its client/server setup. Review the Windows limitation and the separate console requirements if those apply to your deployment.
The facts
Each one read from Samhain's own pages, with the date it was checked.
What it does
- Central management
- The client/server system uses Yule to collect client reports, distribute baseline databases and configuration files, and track client status.checked 4 Oct 2026
- Database support
- The fact sheet lists Oracle, MySQL, and PostgreSQL for storing client reports; it says a database is needed for the Beltane console.checked 4 Oct 2026
- Deployment
- It can run standalone on one host or monitor multiple hosts through a client/server setup with centralized logging and maintenance.checked 4 Oct 2026
- Documentation and support
- The project provides a user manual, FAQ, HOWTOs, user forum, and a support contact address.checked 4 Oct 2026
- File checks
- It can check file checksums and metadata including permissions, ownership, timestamps, inode, and symbolic link targets.checked 4 Oct 2026
- File integrity
- It can check file checksums and attributes including size, permissions, ownership, timestamps, inode, and symbolic link targets.checked 4 Oct 2026
- Integrations
- Samhain can function as a Prelude sensor, includes a Nagios plugin, and can send messages to named pipes, System V message queues, and external programs.checked 4 Oct 2026
- Latest listed release
- The download page lists version 4.5.3, released October 31, 2025, and provides a SHA-256 checksum and PGP signature verification instructions.checked 4 Oct 2026
- License
- Samhain is distributed under the GNU General Public Licence.checked 4 Oct 2026
- License and release
- Samhain is distributed under the GNU General Public Licence; the download page lists version 4.5.3, released October 31, 2025.checked 4 Oct 2026
- Log monitoring
- Optional log analysis supports UNIX syslog, Apache access and error logs, Samba logs, and BSD style process accounting logs.checked 4 Oct 2026
- Management console
- Beltane is a separate web based PHP console for viewing client reports and updating baseline databases; it requires a Samhain client/server installation and SQL logging.checked 4 Oct 2026
- Monitoring
- Optional checks cover log formats including UNIX syslog and Apache logs, Windows registry keys under Cygwin, SUID/SGID files, open ports, hidden or fake processes, mounted filesystems, and login events.checked 4 Oct 2026
- Notable limit
- The fact sheet says Windows/Cygwin support is tested for the Samhain monitoring agent only, not the server.checked 4 Oct 2026
- PCI DSS
- The fact sheet describes incremental checks on growing log files as supporting the PCI DSS requirement to detect changes to existing log data.checked 4 Oct 2026
- Project publisher
- The legal notice names WEP e.V., Samhain Labs department, as the editorial responsibility and lists Dr. Rainer Wichmann in Lüneburg, Germany.checked 4 Oct 2026
- Purpose
- Samhain is a file integrity and host based intrusion detection system that monitors files and logs, and detects rootkits, rogue SUID executables, open ports, and hidden processes.checked 4 Oct 2026
- Security
- Samhain supports signed database and configuration files, signed reports, authenticated client connections, encrypted central logging, and stealth options.checked 4 Oct 2026
- Support
- Support options include documentation, a user forum and mailing list, bug reports by contact form or email, and an inquiry option for commercial installation or maintenance support.checked 4 Oct 2026
- Tamper resistance
- The project describes signed configuration and database files, signed reports, encrypted messages to the central log server, and stealth options.checked 4 Oct 2026
- Web console
- Beltane is a separate web-based console that presents client reports and supports updating centrally stored baseline databases.checked 4 Oct 2026
Where it runs
- Linux monitoring
- On Linux, inotify can provide immediate file change notifications, and the kernel audit system can identify the login user who changed a file.checked 4 Oct 2026
- Platforms
- The fact sheet lists POSIX systems including Linux, BSD, Solaris, AIX, HP-UX, and Mac OS X, plus Windows 2000/XP with POSIX emulation; Windows support is tested for the agent only, not the server.checked 4 Oct 2026
Alternatives to Samhain
- 1
Wazuh
Free planOpen sourceWebAPILinuxmacOS8.4From $571 a month - 2
OSSEC
Free planOpen sourceAPILinuxmacOSSelf-hosted8.0From $55 a year - 3
Kaspersky Endpoint Security for Business
AndroidiOSWebAPI7.8From $29.99 a month - 4
PA File Sight
AndroidiOSWebAPI7.7From $30 a month - 5
Paessler PRTG Network Monitor
Free planAndroidiOSWebAPI7.7From $200 a month - 6
Avidemux
Free planOpen sourceWebLinuxmacOSWindows7.3Free plan