---
title: 'lfd:directorywatching'
url: 'https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-directorywatching'
markdown: 'https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-directorywatching.md'
date: '2026-10-07'
description: 'Configure the checking of directories for suspicious files. juggernaut --task=lfd:directorywatching Option Value Default Description --LF_DIRWATCH_FILE 0 The interval in seconds to have the login failure daemon watch specified files or directories for changes. If a change is detected then a…'
taxonomy:
  category:
    - docs
  tag:
    - monitoring
---

[](#)  [ Basics ](https://docs.danami.com/juggernaut/)     [ Command Line Interface ](https://docs.danami.com/juggernaut/command-line-interface)      Lfd       lfd:directorywatching    

# lfd:directorywatching

Configure the checking of directories for suspicious files.

```
juggernaut --task=lfd:directorywatching
```

| Option | Value | Default | Description |
|---|---|---|---|
| `--LF_DIRWATCH_FILE` |  | 0 | The interval in seconds to have the login failure daemon watch specified files or directories for changes. If a change is detected then an alert is sent. |
| `--LF_DIRWATCH` | <0\|30-86400> | 300 | This tells the login failure daemon to check /tmp and /dev/shm directories for suspicious files. If a suspicious file is found an email alert is sent. One alert per file per LF\_FLUSH interval is sent. To enable this feature set the following to the checking interval in seconds. To disable this option set to 0. |
| `--LF_DIRWATCH_DISABLE` | <1\|0> | 0 | Enable the removal any suspicious files found during directory watching. These files will be appended to a tarball located in /etc/csf/suspicious.tar |
| `--LF_INTEGRITY` | <0\|120-86400> | 3600 | The interval in seconds to have the login failure daemon compare md5sums of the servers OS binary application files from the time when the login failure daemon was started. If the md5sum of a monitored file is mismatched then an alert is sent. This option acts as an IDS (Intrusion Detection System) in detecting a possible root compromise. |
| `--default` | <yes> |  | Reset all settings to their default values. |
| `--default_option` | <option> |  | Reset a specific setting to its default value. |
| `--restart` | <yes> |  | Restart the service after saving settings. |

## Examples

```
// enable LF_DIRWATCH_DISABLE
juggernaut --task=lfd:directorywatching --LF_DIRWATCH_DISABLE=1 --restart=yes

// reset LF_DIRWATCH_DISABLE back to default
juggernaut --task=lfd:directorywatching --default_option=LF_DIRWATCH_DISABLE --restart=yes

// reset all settings back to default
juggernaut --task=lfd:directorywatching --default=yes --restart=yes

// watch /tmp every 30 seconds and quarantine suspicious files instead of just alerting
juggernaut --task=lfd:directorywatching --LF_DIRWATCH=30 --LF_DIRWATCH_DISABLE=1 --restart=yes

// run file integrity checks every 30 minutes to catch trojaned system binaries
juggernaut --task=lfd:directorywatching --LF_INTEGRITY=1800 --restart=yes
```

## Related Pages

- [Directory Watching](https://docs.danami.com/juggernaut/user-guide/directory-watching "Directory Watching")
- [Logging Settings](https://docs.danami.com/juggernaut/settings/firewall/logging-settings "Logging Settings")
- [Directory Watching](https://docs.danami.com/juggernaut/settings/login-failure-daemon/directory-watching "Directory Watching")
- [Statistics Settings](https://docs.danami.com/juggernaut/settings/login-failure-daemon/statistics-settings "Statistics Settings")

 [ ](https://docs.danami.com/juggernaut/command-line-interface/firewall/firewall-logging) [](https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-directorywatching-paths)

---

## Navigation

- Previous: [lfd:country](https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-country.md)
- Next: [lfd:directorywatching:paths](https://docs.danami.com/juggernaut/command-line-interface/lfd/lfd-directorywatching-paths.md)