Description

This PR aims to add a new option for FIM.
With this option, a limit can be set for how many files per second are read.
If this limit is reached, the scan will be stoped for 1 second and it will continue as normal.

Closes #5645

Configuration options

<syscheck>
    <disabled>no</disabled>

    <!-- Directories to check  (perform all possible verifications) -->
    <directories>/test</directories>
    <max_files_per_second>75</max_files_per_second

Logs/Alerts example

2020/12/04 13:06:40 ossec-syscheckd[23270] create_db.c:62 at fim_scan(): INFO: (6008): File integrity monitoring scan started.
2020/12/04 13:06:40 ossec-syscheckd[23270] run_check.c:102 at send_syscheck_msg(): DEBUG: (6321): Sending FIM event: {"type":"scan_start","data":{"timestamp":1607087200}}
2020/12/04 13:06:40 ossec-syscheckd[23270] create_db.c:68 at fim_scan(): DEBUG: (6348): Size of '/var/ossec/queue/diff' folder: 0.00000 KB.
2020/12/04 13:06:40 ossec-syscheckd[23270] run_check.c:149 at check_max_fps(): DEBUG: (6258): Maximum number of files read per second reached, sleeping.

Tests

• Compilation without warnings in every supported platform
  • Linux
  • Windows
  • MAC OS X
• Source installation
• Source upgrade
• Review logs syntax and correct language

• Memory tests for Linux
  • Scan-build report
  • Coverity
  • Valgrind (memcheck and descriptor leaks check)
• Memory tests for Windows
  • Scan-build report
• Memory tests for macOS
  • Scan-build report
  • Leaks
  • AddressSanitizer