Samhain
- Android app
- Not listed
- Free plan
- No
- Runs on
- Linux, Mac, self-hosted, Windows
Summary
Samhain is a free file-integrity and host-based intrusion detection system for monitoring files, logs, and other host activity. It checks file checksums and attributes such as permissions, ownership, timestamps, inode, and symbolic-link targets, and can detect rootkits, rogue SUID executables, open ports, and hidden processes. It can run on one host or use a client/server setup: Yule collects reports, distributes baselines and configuration, and tracks client status. Optional log analysis covers formats including UNIX syslog and Apache logs. Security measures include signed configuration and reports, authenticated client connections, encrypted central logging, and stealth options. Beltane is a separate web console that requires client/server installation and SQL logging. Samhain is distributed under the GNU General Public Licence and supports Linux, macOS, Windows via Cygwin, and other POSIX systems. The listed Windows/Cygwin testing applies to the monitoring agent, not the server. The latest listed release is version 4.5.3, released October 31, 2025.
Who it is for
Samhain may suit administrators who need file and host monitoring on one machine or across multiple hosts. Those considering Windows should note that Cygwin support is tested for the monitoring agent only, not the server.
What is good
- Checks file checksums and metadata.
- Can monitor one host or multiple hosts centrally.
- Optional log analysis covers UNIX syslog and Apache logs.
- Provides signed reports and encrypted central logging.
What to know first
- Windows/Cygwin testing covers the agent, not the server.
- Beltane requires client/server installation and SQL logging.
- Beltane is a separate web console.
Verdict
Samhain offers file-integrity checks and host monitoring, with centralized management available through its client/server setup. Review the Windows limitation and the separate console requirements if those apply to your deployment.
Compared on file integrity monitoring software
- Free plan
- Yesla-samhna.de
- Deployment
- on_premisesla-samhna.de
- Real-time alerts
- Yesla-samhna.de
- Configuration monitoring
- Yesla-samhna.de
- Agentless monitoring
- Nola-samhna.de
- Supported platforms
- POSIX systems including Linux, *BSD, Solaris, AIX, HP-UX, Mac OS X; Windows via Cygwinla-samhna.de
Facts
- Purpose
- Samhain is a file integrity and host based intrusion detection system that monitors files and logs, and detects rootkits, rogue SUID executables, open ports, and hidden processes.la-samhna.de · 4 Oct 2026
- File checks
- It can check file checksums and metadata including permissions, ownership, timestamps, inode, and symbolic link targets.la-samhna.de · 4 Oct 2026
- Linux monitoring
- On Linux, inotify can provide immediate file change notifications, and the kernel audit system can identify the login user who changed a file.la-samhna.de · 4 Oct 2026
- Log monitoring
- Optional log analysis supports UNIX syslog, Apache access and error logs, Samba logs, and BSD style process accounting logs.la-samhna.de · 4 Oct 2026
- Integrations
- Samhain can function as a Prelude sensor, includes a Nagios plugin, and can send messages to named pipes, System V message queues, and external programs.la-samhna.de · 4 Oct 2026
- Database support
- The fact sheet lists Oracle, MySQL, and PostgreSQL for storing client reports; it says a database is needed for the Beltane console.la-samhna.de · 4 Oct 2026
- Management console
- Beltane is a separate web based PHP console for viewing client reports and updating baseline databases; it requires a Samhain client/server installation and SQL logging.la-samhna.de · 4 Oct 2026
- Tamper resistance
- The project describes signed configuration and database files, signed reports, encrypted messages to the central log server, and stealth options.la-samhna.de · 4 Oct 2026
- License
- Samhain is distributed under the GNU General Public Licence.la-samhna.de · 4 Oct 2026
- Latest listed release
- The download page lists version 4.5.3, released October 31, 2025, and provides a SHA-256 checksum and PGP signature verification instructions.la-samhna.de · 4 Oct 2026
- Documentation and support
- The project provides a user manual, FAQ, HOWTOs, user forum, and a support contact address.la-samhna.de · 4 Oct 2026
- Project publisher
- The legal notice names WEP e.V., Samhain Labs department, as the editorial responsibility and lists Dr. Rainer Wichmann in Lüneburg, Germany.la-samhna.de · 4 Oct 2026
- File integrity
- It can check file checksums and attributes including size, permissions, ownership, timestamps, inode, and symbolic link targets.la-samhna.de · 4 Oct 2026
- Monitoring
- Optional checks cover log formats including UNIX syslog and Apache logs, Windows registry keys under Cygwin, SUID/SGID files, open ports, hidden or fake processes, mounted filesystems, and login events.la-samhna.de · 4 Oct 2026
- Central management
- The client/server system uses Yule to collect client reports, distribute baseline databases and configuration files, and track client status.la-samhna.de · 4 Oct 2026
- Web console
- Beltane is a separate web-based console that presents client reports and supports updating centrally stored baseline databases.la-samhna.de · 4 Oct 2026
- Security
- Samhain supports signed database and configuration files, signed reports, authenticated client connections, encrypted central logging, and stealth options.la-samhna.de · 4 Oct 2026
- PCI DSS
- The fact sheet describes incremental checks on growing log files as supporting the PCI DSS requirement to detect changes to existing log data.la-samhna.de · 4 Oct 2026
- Platforms
- The fact sheet lists POSIX systems including Linux, BSD, Solaris, AIX, HP-UX, and Mac OS X, plus Windows 2000/XP with POSIX emulation; Windows support is tested for the agent only, not the server.la-samhna.de · 4 Oct 2026
- License and release
- Samhain is distributed under the GNU General Public Licence; the download page lists version 4.5.3, released October 31, 2025.la-samhna.de · 4 Oct 2026
- Support
- Support options include documentation, a user forum and mailing list, bug reports by contact form or email, and an inquiry option for commercial installation or maintenance support.la-samhna.de · 4 Oct 2026
- Notable limit
- The fact sheet says Windows/Cygwin support is tested for the Samhain monitoring agent only, not the server.la-samhna.de · 4 Oct 2026
Best Samhain alternatives
See all 20
Where it ranks on Everything Xiaomi
Is Samhain yours?
Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.
Sources
- la-samhna.de/samhain/· checked 4 Oct 2026
- la-samhna.de/samhain/s_faq.html· checked 4 Oct 2026
- la-samhna.de/beltane/index.html· checked 4 Oct 2026
- la-samhna.de/samhain/s_download.html· checked 4 Oct 2026
- la-samhna.de/samhain/s_documentation.html· checked 4 Oct 2026
- la-samhna.de/impressum.html· checked 4 Oct 2026
- la-samhna.de/services.html· checked 4 Oct 2026