This is from here: SourceForge.net: Rootkit Hunter FAQ
3.3) How can I automatically run Rootkit Hunter every day?
A. There are several ways that rkhunter can be run via cron. However,
it must be remembered that cron will automatically email any output
produced by the program to the root user. Secondly, when the rkhunter
‘–cronjob’ option is used, the program will generally not produce
any output. It is, therefore, necessary to tell rkhunter what output
should be shown. Typically this will just be any warning messages,
and this can be achieved by using the ‘–rwo’ (report warnings only)
option.
For the first example, the rkhunter command could be added directly
to the root crontab:
30 5 * * * /usr/local/bin/rkhunter --cronjob --update --rwo
This would run rkhunter at 5:30 (AM) every day. If no output is
produced by rkhunter, then nothing is emailed to root. Any output
this is produced, which would only be warning messages, is
automatically emailed to root by the cron process.
Note that the '--update' option has been included. Rkhunter will
first perform any updates required to its data files, and then
perform the system checks. This option can be omitted, but it is
suggested that the option is used regularly to ensure that the
rkhunter data files are kept up todate.
If it is wished that all the normal output of rkhunter, as seen when
running rkhunter from the command-line, is emailed to root, then this
is possible. The '--rwo' option should be removed, and the '--cronjob'
option replaced by '--sk --nocolors --check'.
The next example is of a cronjob script. For Linux systems this
script could be put in to the /etc/cron.daily directory, so that
it will be automatically run every day.
The script might look like this:
#!/bin/sh
( /usr/local/bin/rkhunter --cronjob --update --rwo && echo "" ) \
| /bin/mail -s "Rkhunter daily run on `uname -n`" root
exit 0
Because we are piping any output through to the mail command, it is
required to use 'echo ""' when there are no warnings. Without this,
the mail command would issue its own warning about there being no
message body.
If it is wished to include the date in the output, then something
like this could be used instead:
#!/bin/sh
( date; /usr/local/bin/rkhunter --cronjob --update --rwo ) \
| /bin/mail -s "Rkhunter daily run on `uname -n`" root
exit 0
Finally, it is possible to run rkhunter in quiet-mode, whereby no
output will be produced at all. However, if the return code indicates
that warnings were found, then we get cron to mail the root user.
For example:
30 5 * * * /usr/local/bin/rkhunter --cronjob --update --quiet \
|| echo "Rkhunter daily run on `uname -n` has produced warning messages"
An alternative to the above example would be to use:
30 5 * * * /usr/local/bin/rkhunter --cronjob --update --quiet
and then simply set the MAIL-ON-WARNING option in the configuration
file with the root email address. This way, rkhunter produces no
output, and so nothing is emailed to root by cron. However, if any
warnings are found during the system check, then a notice message is
emailed to root by rkhunter itself.
Note: The '--quiet' option in the above two examples is not actually
necessary, but was included for clarity. The '--cronjob' option assumes
the '--quiet' option, and so, as mentioned above, when rkhunter is run
with the '--cronjob' option no output is generally produced.