Skip to content

Scheck Configuration¶

Version: 1.0.7-7-g251eead
Release Date: 2023-04-06 11:17:57
Supported OS: windows/amd64, windows/386, linux/arm, linux/arm64, linux/386, linux/amd64

Configuration Description¶

Navigate to the default installation directory /usr/local/scheck and open the configuration file scheck.conf. The configuration file uses the TOML format and is described as follows:

[system]
  # ##(Required) Directory where the system stores detection scripts
  rule_dir = "/usr/local/scheck/rules.d"
  # ##Custom directory for the customer
  custom_dir = "/usr/local/scheck/custom.rules.d"
  #Hot reload
  lua_HotUpdate = false
  cron = ""
  #Whether to disable logging
  disable_log = false
  #System rule blacklist
  system_rule_black_list = [] 

[scoutput]
   # ##Messages generated during security check can be sent to local, http, Alibaba Cloud SLS.
   # ##Remote server, e.g.: http(s)://your.url
  [scoutput.http]
    enable = true
    output = "http://127.0.0.1:9529/v1/write/security"
  [scoutput.log]
    # ##Can be configured for local storage
    enable = false
    output = "/var/log/scheck/event.log"
  # Alibaba Cloud Log Service
  [scoutput.alisls]
    enable = false
    endpoint = ""
    access_key_id = ""
    access_key_secret = ""
    project_name = "zhuyun-scheck"
    log_store_name = "scheck"

[logging]
  # ##(Optional) Storage location for logs generated during program runtime
  log = "/var/log/scheck/log"
  log_level = "info"
  rotate = 0

[cgroup]
    # Optional, disabled by default, can control CPU and memory
  enable = false
  cpu_max = 30.0
  cpu_min = 5.0
  mem = 0

system module¶

[system]
  # ##(Required) Directory where the system stores detection scripts
  rule_dir = "/usr/local/scheck/rules.d"
  # ##Custom directory for the customer
  custom_dir = "/usr/local/scheck/custom.rules.d"
  #Hot reload
  lua_HotUpdate = ""
  cron = ""
  #Whether to disable logging
  disable_log = false
  #System rule blacklist
  system_rule_black_list = ["all",]

Parameter	Type	Description
rule_dir	string	Directory where the system stores detection scripts
custom_dir	string	Custom directory for the customer
lua_HotUpdate	bool	Hot reload, supports loading Lua scripts every 10 seconds
cron	string	Force all scheduled times
disable_log	bool	Whether to disable logging
system_rule_black_list	array	Whether to disable system rules (supports regex) ["all","0100*"]

scoutput module¶

[scoutput]
   # ##Messages generated during security check can be sent to local, http, Alibaba Cloud SLS.
   # ##Remote server, e.g.: http(s)://your.url
  [scoutput.http]
    enable = true
    output = "http://127.0.0.1:9529/v1/write/security"
  [scoutput.log]
    # ##Can be configured for local storage
    enable = false
    output = "/var/log/scheck/event.log"
  # Alibaba Cloud Log Service
  [scoutput.alisls]
    enable = false
    endpoint = ""
    access_key_id = ""
    access_key_secret = ""
    project_name = "zhuyun-scheck"
    log_store_name = "scheck"

Parameter	Type	Description
scoutput.http		HTTP output module
enable	bool	Whether to enable
output	string	DataKit API address
scoutput.log
enable	bool	Whether to enable
output	string	File path
scoutput.alisls
enable	bool	Whether to enable
endpoint	string	Alibaba Cloud region
access_key_id	string	Alibaba Cloud AccessKey ID
access_key_secret	string	Alibaba Cloud AccessKey Secret
project_name	string	Project name
log_store_name	string	Log store name

logging module¶

[logging]
  # ##(Optional) Storage location for logs generated during program runtime
  log = "/var/log/scheck/log"
  log_level = "info"
  rotate = 0

Parameter	Type	Description
log	string	Path to scheck system logs
log_level	string	Log level for scheck
rotate	int	Default 0, log rotation size in MB, default 30MB

cgroup module¶

[cgroup]
    # Optional, disabled by default, can control CPU and memory
  enable = false
  cpu_max = 30.0
  cpu_min = 5.0
  mem = 0

Parameter	Type	Description
enable	bool	Whether to enable
cpu_max	float	Maximum CPU limit
mem	float	Minimum CPU limit

Other¶

How to disable system rules¶

[system]
  ....
  #System rule blacklist
  system_rule_black_list = ["all",]

Disable all system rules

system_rule_black_list = ["all"]

Disable container-related rules

system_rule_black_list = ["03.*"]

System ID Specification