No. 17 of 29 ·File Integrity Monitoring Software

Samhain

Windows · Mac · Linux · Self-hosted

Freedom report

Two barsScore 5.5

Free tierNo free tier on record
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

Samhain is ranked #17 of 29 in file integrity monitoring software on Freedom251. It runs on Linux, macOS, Self-hosted, Windows.

Compared on file integrity monitoring software

Free plan: Yes
Deployment: on_premises
Real-time alerts: Yes
Configuration monitoring: Yes
Agentless monitoring: No
Supported platforms: POSIX systems including Linux, *BSD, Solaris, AIX, HP-UX, Mac OS X; Windows via Cygwin

Best Samhain alternatives

See all 20

Two bars Paessler PRTG Network Monitor Free tier No. 1$16.67/mo6.8 Two bars EventSentry File Monitoring Free tier No. 2Free6.6 Two bars Wazuh Free tier No. 3$571/mo6.6 Two bars FIM Free tier No. 4Free6.5 Two bars Open Source Tripwire Free tier No. 5Free6.5 Two bars OSSEC Free tier No. 6$5/mo6.5

The record

Purpose: Samhain is a file integrity and host based intrusion detection system that monitors files and logs, and detects rootkits, rogue SUID executables, open ports, and hidden processes.
File checks: It can check file checksums and metadata including permissions, ownership, timestamps, inode, and symbolic link targets.
Linux monitoring: On Linux, inotify can provide immediate file change notifications, and the kernel audit system can identify the login user who changed a file.
Log monitoring: Optional log analysis supports UNIX syslog, Apache access and error logs, Samba logs, and BSD style process accounting logs.
Integrations: Samhain can function as a Prelude sensor, includes a Nagios plugin, and can send messages to named pipes, System V message queues, and external programs.
Database support: The fact sheet lists Oracle, MySQL, and PostgreSQL for storing client reports; it says a database is needed for the Beltane console.
Management console: Beltane is a separate web based PHP console for viewing client reports and updating baseline databases; it requires a Samhain client/server installation and SQL logging.
Tamper resistance: The project describes signed configuration and database files, signed reports, encrypted messages to the central log server, and stealth options.
License: Samhain is distributed under the GNU General Public Licence.
Latest listed release: The download page lists version 4.5.3, released October 31, 2025, and provides a SHA-256 checksum and PGP signature verification instructions.
Documentation and support: The project provides a user manual, FAQ, HOWTOs, user forum, and a support contact address.
Project publisher: The legal notice names WEP e.V., Samhain Labs department, as the editorial responsibility and lists Dr. Rainer Wichmann in Lüneburg, Germany.
File integrity: It can check file checksums and attributes including size, permissions, ownership, timestamps, inode, and symbolic link targets.
Monitoring: Optional checks cover log formats including UNIX syslog and Apache logs, Windows registry keys under Cygwin, SUID/SGID files, open ports, hidden or fake processes, mounted filesystems, and login events.

Where it ranks on Freedom251

Best File Integrity Monitoring Software in 2026#17 of 29

Is Samhain yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote Samhain

Sources

la-samhna.de/samhain/· checked 4 Oct 2026
la-samhna.de/samhain/s_faq.html· checked 4 Oct 2026
la-samhna.de/beltane/index.html· checked 4 Oct 2026
la-samhna.de/samhain/s_download.html· checked 4 Oct 2026
la-samhna.de/samhain/s_documentation.html· checked 4 Oct 2026
la-samhna.de/impressum.html· checked 4 Oct 2026
la-samhna.de/services.html· checked 4 Oct 2026