---
title: 'antimalware:monitoring'
url: 'https://docs.danami.com/sentinel/command-line-interface/antimalware/antimalware-monitoring'
markdown: 'https://docs.danami.com/sentinel/command-line-interface/antimalware/antimalware-monitoring.md'
date: '2026-10-07'
description: "Configure the anti-malware real-time file monitoring settings. sentinel --task=antimalware:monitoring Option Value Default Description --default_monitor_mode <string> users The default startup option for monitor mode, either 'users' or '/usr/local/maldetect/monitor_paths' (a file containi…"
taxonomy:
  category:
    - docs
  tag:
    - monitor
---

[](#)  [ Basics ](https://docs.danami.com/sentinel/)     [ Command Line Interface ](https://docs.danami.com/sentinel/command-line-interface)      Antimalware       antimalware:monitoring    

# antimalware:monitoring

Configure the anti-malware real-time file monitoring settings.

```
sentinel --task=antimalware:monitoring
```

| Option | Value | Default | Description |
|---|---|---|---|
| `--default_monitor_mode` | <string> | users | The default startup option for monitor mode, either 'users' or '/usr/local/maldetect/monitor\_paths' (a file containing local paths to monitor). This option is REQUIRED for the systemd maldet.service script. That script only checks for the value of $default\_monitor\_mode. The service will fail to start if a value is not provided. |
| `--inotify_base_watches` | <digit> | 16384 | The base number of files that can be watched under a path. (maximum file watches = inotify\_base\_watches\*users) |
| `--inotify_sleep` | <digit> | 30 | The sleep time in seconds between monitor runs to scan files that have been created/modified/moved. |
| `--inotify_reloadtime` | <digit> | 3600 | The interval in seconds that inotify will reload configuration data, including remote configuration imports. |
| `--inotify_minuid` | <digit> | 10000 | The minimum userid that will be added to path monitoring when the USERS option is specified. |
| `--inotify_docroot` | <string> | httpdocs | This is the html/web root for users relative to homedir, when this option is set, users will only have the webdir monitored \[clear option to default monitor entire user homedir\] |
| `--inotify_cpunice` | <int> | 18 | Process CPU scheduling (nice) priority level for scan operations. \[-19 = high prio , 19 = low prio, default = 19\] |
| `--inotify_ionice` | <digit> | 6 | Process IO scheduling (ionice) priority levels for scan operations. (uses cbq best-effort scheduling class \[-c2\]). \[0 = most favorable IO, 7 = least favorable IO\] |
| `--inotify_cpulimit` | <digit> | 0 | Set hard limit on CPU usage for inotify monitoring processes. This requires the "cpulimit" binary to be available on the server. The values are expressed as relative percentage \* N cores on system. An 8 CPU core system would accept values from 0 to 800, a 12 cores system would accept 0 - 1200 etc. |
| `--inotify_verbose` | <1\|0> | 0 | Log every file scanned by inotify monitoring mode; this is not recommended and will drown out your "event\_log" file, intended only for debugging purposes. |
| `--digest_interval` | <string> | 24h | Periodic digest summary interval for monitor mode. Supports: Nh (hours), Nm (minutes), Nd (days). 0 = disabled. When enabled, the monitor fires a digest alert at this interval summarizing all detections since the last digest. The cron.daily --monitor-report fallback still works independently. Default: 24h (matches current daily cron behavior) |
| `--digest_escalate_hits` | <1\|0> | 0 | Immediate escalation threshold for monitor mode. When a single monitor scan cycle finds this many (or more) malware hits, fire an immediate per-scan alert in addition to the periodic digest. 0 = disabled (legacy behavior — no per-cycle alerts). |
| `--cron_digest_hook` | <1\|0> | 1 | Enable cron.daily hook digest sweep. When enabled, cron.daily checks hook.hits.log for new detections and fires a digest alert if any are found since the last sweep. |
| `--monitor_scan_owner_filters` | <1\|0> |  | Apply scan\_ignore\_root/scan\_ignore\_user/scan\_ignore\_group ownership filters during monitor mode file evaluation. When disabled monitor mode scans all files regardless of owner — this is the correct behavior for shared-hosting environments where root-owned PHP drop-ins are a real threat vector and must not be silently skipped. When enabled ownership filters from scan\_ignore\_root/scan\_ignore\_user/scan\_ignore\_group are applied in monitor mode. We recommend leaving this disabled. |
| `--default` | <yes> |  | Reset all settings to their default values. |
| `--default_option` | <option> |  | Reset a specific setting to its default value. |
| `--restart` | <yes> |  | Restart the service after saving settings. |

## Examples

```
// set default_monitor_mode
sentinel --task=antimalware:monitoring --default_monitor_mode=/usr/local/maldetect/monitor_paths --restart=yes

// reset the default_monitor_mode back to its default value
sentinel --task=antimalware:monitoring --default_option=default_monitor_mode --restart=yes

// reset all settings to their default values
sentinel --task=antimalware:monitoring --default=yes --restart=yes

// only monitor each user's web directory instead of the whole home directory
sentinel --task=antimalware:monitoring --inotify_docroot=httpdocs --restart=yes

// fire an immediate alert when a single scan cycle finds 5 or more hits
sentinel --task=antimalware:monitoring --digest_escalate_hits=5 --restart=yes
```

## Related Pages

- [Monitoring Settings](https://docs.danami.com/sentinel/settings/antimalware/monitoring-settings "Monitoring Settings")

 [](https://docs.danami.com/sentinel/command-line-interface/antimalware/antimalware-monitoring-paths)

---

## Navigation

- Previous: [antimalware:ignore](https://docs.danami.com/sentinel/command-line-interface/antimalware/antimalware-ignore.md)
- Next: [antimalware:monitoring:paths](https://docs.danami.com/sentinel/command-line-interface/antimalware/antimalware-monitoring-paths.md)