rkhunter is a tool to detect rootkits installed on your system and suspicious file changes. In order for rkhunter to run these checks, it maintains a catalog of files and their properties installed on your system so it can compare current files and statusses against the ones recorded in its database. Out of the box rkhunter is configured to give as few false positives as possible on a Mageia system. Still, despite this, you might want to change some of its configuration options yourself to best suit you. The file used for this is /etc/rkhunter.conf Upon an initial install, rkhunter will create the databases it needs itself. On upgrades and during regular use, you may want to update its databases yourself by executing: rkhunter --propupd before running any other rkhunter checks yourself.