Samhain

6.3easy start · #20 of 29
in File Integrity Monitoring Software

Free to practise onnot on record
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Linux, Mac, self-hosted, Windows.

Samhain is ranked #20 of 29 in file integrity monitoring software on The Geeks Club. It runs on Linux, macOS, Self-hosted, Windows.

Compared on file integrity monitoring software

Free plan: Yes
Deployment: on_premises
Real-time alerts: Yes
Configuration monitoring: Yes
Agentless monitoring: No
Supported platforms: POSIX systems including Linux, *BSD, Solaris, AIX, HP-UX, Mac OS X; Windows via Cygwin

Best Samhain alternatives

See all 12

Paessler PRTG Network Monitor 0 of 4 in the starter kit Lesson 18.0 Wazuh 0 of 4 in the starter kit Lesson 27.8 EventSentry File Monitoring 0 of 4 in the starter kit Lesson 37.7 Elastic Security 0 of 4 in the starter kit Lesson 47.6 OSSEC 0 of 4 in the starter kit Lesson 57.6 CimTrak Integrity Suite 0 of 4 in the starter kit Lesson 67.1

The record

Purpose: Samhain is a file integrity and host based intrusion detection system that monitors files and logs, and detects rootkits, rogue SUID executables, open ports, and hidden processes.
File checks: It can check file checksums and metadata including permissions, ownership, timestamps, inode, and symbolic link targets.
Linux monitoring: On Linux, inotify can provide immediate file change notifications, and the kernel audit system can identify the login user who changed a file.
Log monitoring: Optional log analysis supports UNIX syslog, Apache access and error logs, Samba logs, and BSD style process accounting logs.
Integrations: Samhain can function as a Prelude sensor, includes a Nagios plugin, and can send messages to named pipes, System V message queues, and external programs.
Database support: The fact sheet lists Oracle, MySQL, and PostgreSQL for storing client reports; it says a database is needed for the Beltane console.
Management console: Beltane is a separate web based PHP console for viewing client reports and updating baseline databases; it requires a Samhain client/server installation and SQL logging.
Tamper resistance: The project describes signed configuration and database files, signed reports, encrypted messages to the central log server, and stealth options.
License: Samhain is distributed under the GNU General Public Licence.
Latest listed release: The download page lists version 4.5.3, released October 31, 2025, and provides a SHA-256 checksum and PGP signature verification instructions.
Documentation and support: The project provides a user manual, FAQ, HOWTOs, user forum, and a support contact address.
Project publisher: The legal notice names WEP e.V., Samhain Labs department, as the editorial responsibility and lists Dr. Rainer Wichmann in Lüneburg, Germany.
File integrity: It can check file checksums and attributes including size, permissions, ownership, timestamps, inode, and symbolic link targets.
Monitoring: Optional checks cover log formats including UNIX syslog and Apache logs, Windows registry keys under Cygwin, SUID/SGID files, open ports, hidden or fake processes, mounted filesystems, and login events.

Where it ranks on The Geeks Club

Best File Integrity Monitoring Software in 2026#20 of 29

Is Samhain yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Samhain

Sources

la-samhna.de/samhain/· checked 4 Oct 2026
la-samhna.de/samhain/s_faq.html· checked 4 Oct 2026
la-samhna.de/beltane/index.html· checked 4 Oct 2026
la-samhna.de/samhain/s_download.html· checked 4 Oct 2026
la-samhna.de/samhain/s_documentation.html· checked 4 Oct 2026
la-samhna.de/impressum.html· checked 4 Oct 2026
la-samhna.de/services.html· checked 4 Oct 2026