---
title: 'Monitoring Settings'
url: 'https://docs.danami.com/sentinel/settings/antimalware/monitoring-settings'
markdown: 'https://docs.danami.com/sentinel/settings/antimalware/monitoring-settings.md'
date: '2026-10-09'
description: 'Default monitor mode - default_monitor_mode The default startup option for monitor mode, either users or /usr/local/maldetect/monitor_paths (a file containing local paths to monitor). This option is REQUIRED for the systemd maldet.service script. That script only checks for the value of $default_mo…'
taxonomy:
  category:
    - docs
  tag:
    - monitor
---

[](#)  [ Basics ](https://docs.danami.com/sentinel/)     [ Settings Reference ](https://docs.danami.com/sentinel/settings)     [ Antimalware ](https://docs.danami.com/sentinel/settings/antimalware)      Monitoring Settings    

# Monitoring Settings

**Default monitor mode** - `default_monitor_mode`
The default startup option for monitor mode, either users or /usr/local/maldetect/monitor\_paths (a file containing local paths to monitor). This option is REQUIRED for the systemd maldet.service script. That script only checks for the value of $default\_monitor\_mode. The service will fail to start if a value is not provided.
Default: users

**Base watches** - `inotify_base_watches`
The base number of files that can be watched under a path. (maximum file watches = inotify\_base\_watches\*users)
Default: 16384

**Sleep between monitor runs** - `inotify_sleep`
The sleep time in seconds between monitor runs to scan files that have been created/modified/moved.
Default: 15

**Config data reload interval** - `inotify_reloadtime`
The interval in seconds that inotify will reload configuration data, including remote configuration imports.
Default: 3600

**Minimum userid that will be added to user monitoring** - `inotify_minuid`
The minimum userid that will be added to path monitoring when the USERS option is specified.
Default: 10000

**Document root for users** - `inotify_docroot`
This is the html/web root for users relative to homedir, when this option is set, users will only have the webdir monitored \[ clear option to default monitor entire user homedir \]
Default: httpdocs

**Process CPU scheduling priority** - `inotify_cpunice`
Process CPU scheduling (nice) priority level for scan operations. \[ -19 = high prio , 19 = low prio, default = 19 \]
Default: 18

**Process IO scheduling priority** - `inotify_ionice`
Process IO scheduling (ionice) priority levels for scan operations. (uses cbq best-effort scheduling class \[-c2\]). \[ 0 = most favorable IO, 7 = least favorable IO \]
Default: 6

**CPU limit** - `inotify_cpulimit`
Set hard limit on CPU usage for inotify monitoring processes. This requires the "cpulimit" binary to be available on the server. The values are expressed as relative percentage \* N cores on system. An 8 CPU core system would accept values from 0 - 800, a 12 cores system would accept 0 - 1200 etc.
Default: 0

**Verbose** - `inotify_verbose`
Log every file scanned by inotify monitoring mode; this is not recommended and will drown out your "event\_log" file, intended only for debugging purposes.
Default: 0

**Digest interval** - `digest_interval`
Periodic digest summary interval for monitor mode. Supports: Nh (hours), Nm (minutes), Nd (days). 0 = disabled. When enabled, the monitor fires a digest alert at this interval summarizing all detections since the last digest. The cron.daily --monitor-report fallback still works independently.
Default: 24h

**Digest escalate hits** - `digest_escalate_hits`
Immediate escalation threshold for monitor mode. When a single monitor scan cycle finds this many (or more) malware hits, fire an immediate per-scan alert in addition to the periodic digest.
Default: 0

**Cron digest hook** - `cron_digest_hook`
Enable cron.daily hook digest sweep. When enabled, cron.daily checks hook.hits.log for new detections and fires a digest alert if any are found since the last sweep.
Default: 1

**Monitor scan owner filters** - `monitor_scan_owner_filters`
Apply scan\_ignore\_root/scan\_ignore\_user/scan\_ignore\_group ownership filters during monitor mode file evaluation. When disabled monitor mode scans all files regardless of owner — this is the correct behavior for shared-hosting environments where root-owned PHP drop-ins are a real threat vector and must not be silently skipped. When enabled ownership filters from scan\_ignore\_root/scan\_ignore\_user/scan\_ignore\_group are applied in monitor mode. We recommend leaving this disabled.
Default: 0

 [ ](https://docs.danami.com/sentinel/command-line-interface/antimalware/antimalware-monitoring-paths)

---

## Navigation

- Parent: [Antimalware](https://docs.danami.com/sentinel/settings/antimalware.md)
- Previous: [Quarantine Settings](https://docs.danami.com/sentinel/settings/antimalware/quarantine-settings.md)
- Next: [Statistical Analysis](https://docs.danami.com/sentinel/settings/antimalware/statistical-analysis.md)