
[global]
daemon = 1                ; Daemon mode. If daemon, must specify out_file
strict = 1                ; strict mode. If strict, block exec prog in block_hash_list and block_prog_list  
verbose = 1               ; Verbose output
quite = 0                 ; Quite mode, no output
log_file = /var/log/apptable.log      ; If daemon mode, log file
block_log_file = /var/log/apptableblock.log      ; If daemon mode, block event log file


; Interp interp_path1 ...
[interp]
;If is relative path, relative apptable installed dir.
;
;Example:
;      apptable intalled dir is /opt/apptable, interp_file is /opt/apptable/config/interp_name_list,
;      [interp_file] item is ./config/interp_name_list or /opt/apptable/config/interp_name_list

interp_file = ./config/interp_name_list
usr_interp_file = ./config/usr_interp_name_list

; Block program path ... 
[block_prog]
block_prog_file = ./config/block_prog_list
usr_block_prog_file = ./config/usr_block_prog_list

; Block program hash path ... 
[block_hash]
block_hash_file = ./config/block_hash_list
usr_block_hash_file = ./config/usr_block_hash_list

;Block program binary hash file is optinal, but it is very efficient
;Translate hash text file to hash binary file with the tool /opt/apptable/sha1text2bin
block_hash_bin_file = ./config/block_hash_bin_list
usr_block_hash_bin_file = ./config/usr_block_hash_bin_list


;Block domain name ... 
[block_url]
block_url_file = ./config/block_url_list
usr_block_url_file = ./config/usr_block_url_list


;Block ipv4 and ipv6 ...
[block_ip]
block_ip_file = ./config/block_ip_list
usr_block_ip_file = ./config/usr_block_ip_list

;Block port ...
[block_port]
block_port_file = ./config/block_port_list
usr_block_port_file = ./config/usr_block_port_list


[update]
enable = 1
interval = 86400 
; 1: Update all block list. eg: windows malware list.
; 0: Only update the necessary block file list.
update_full = 1;
update_server=https://apptable.com.cn:9999
cert_path=./config/apptable.crt
update_log = /var/log/apptable_manager.log


;scan malware
[malware]
;Scan malware interval. Min value is 3600s (1 hour)
;  0: disable scan malware. Default is 86400 (1 day)
;
;Perform the first scan 120 seconds after the first update malware db.
interval = 86400

;Log level
; err / warn / info / debug
log_level=warn

;User custom sha1 db file path. Db file path is separated by ':'.
; Default using system db, if not specified.
block_db_list=

;Do malware file method: none/delete/delete_rx. Default:none.
;  none: nothing do.
;  delete: delete malware file.
;  delete_rx: delete read and execute permission of the malware file.
do_method=delete_rx

;Using cache or no cache
;  1: cache
;  0: no cache
cache=1

;Check all file
; Default check type: elf/sh/bash/dash/perl/python/php/java/ruby/lua/node/nodejs.
all_file_check=1

; scanner 监控的物理文件系统名字，如ext3 ext4 xfs等。每项以冒号:分隔。
; 如果不确定，设置为空，使用默认的值。
; 例如 physical_filesystem=ext3:ext4:xfs
physical_filesystem=

; scanner 跳过监控的目录和文件列表。是目录或者文件的绝对路径。每项以冒号:分隔。
; 例如，不监控/var目录。把/var加入该项后，重启apptable_scan，以后在/var下新创建或者修改的文件，
; 不会进行恶意代码检查。但是手动发送查杀的请求(例如执行/opt/apptable/apptable_scan /)，仍然会检查这些目录和文件。
;
; 忽略的目的，是可以减少apptable_scan的资源使用量。
; 例如 skip_listen=/var/log:/var/cache:/var/crash
skip_listen=
