ignore var/run/utmp

diff --git a/modules/samhain/templates/samhainrc.erb b/modules/samhain/templates/samhainrc.erb
index 4e10fda..fb15124 100644 (file)
--- a/modules/samhain/templates/samhainrc.erb
+++ b/modules/samhain/templates/samhainrc.erb
@@ -159,9 +159,10 @@ file=/etc/dsa
 ##
 ## for these files, changes in signature, timestamps, and size are ignored 
 ##
-file=/var/run/utmp
 file=/etc/motd
 
+# is on tmpfs, ignore.
+#file=/var/run/utmp
 
 
 #####################################################################