Primeiro, de acordo com a página de manual --checkall não é um comando válido. Provavelmente rkhunter interpreta como apenas --check .
A verificação de arquivos de log ausentes e vazios é realizada pelo teste sistema de arquivos . Ambos são verificações definidas pelo usuário; você deve informar rkhunter quais arquivos de log devem ser verificados. Esta é a parte relevante de /etc/rkhunter.conf :
# The two options below may be used to check if a file is missing or empty
# (that is, it has a size of zero). The EMPTY_LOGFILES option will also check
# if the file is missing, since that can be interpreted as a file of no size.
# However, the file will only be reported as missing if the MISSING_LOGFILES
# option hasn't already done this.
#
# Both options are space-separated lists of pathnames, and may be specified
# more than once.
#
# NOTE: Log files are usually 'rotated' by some mechanism. At that time it is
# perfectly possible for the file to be either missing or empty. As such these
# options may produce false-positive warnings when log files are rotated.
#
# For both options the default value is the null string.
#
#EMPTY_LOGFILES=""
#MISSING_LOGFILES=""
Eu acho que é auto-explicativo.
Com relação à mensagem Test 'apps' disabled at users request info, a resposta também está em /etc/rkhunter.conf . É aqui que você deve procurar:
# These two options determine which tests are to be performed. The ENABLE_TESTS
# option can use the word 'ALL' to refer to all of the available tests. The
# DISABLE_TESTS option can use the word 'NONE' to mean that no tests are
# disabled. The list of disabled tests is applied to the list of enabled tests.
#
# Both options are space-separated lists of test names, and both options may
# be specified more than once. The currently available test names can be seen
# by using the command 'rkhunter --list tests'.
#
# The supplied configuration file has some tests already disabled, and these
# are tests that will be used only occasionally, can be considered 'advanced'
# or that are prone to produce more than the average number of false-positives.
#
# Please read the README file for more details about enabling and disabling
# tests, the test names, and how rkhunter behaves when these options are used.
#
# The default values are to enable all tests and to disable none. However, if
# either of the options below are specified, then they will override the
# program defaults.
#
# hidden_procs test requires the unhide and/or unhide.rb commands which are
# part of the unhide respectively unhide.rb packages in Debian.
#
# apps test is disabled by default as it triggers warnings about outdated
# applications (and warns about possible security risk: we better trust
# the Debian Security Team).
#
ENABLE_TESTS=ALL
DISABLE_TESTS=suspscan hidden_procs deleted_files packet_cap_apps apps
Você pode remover de DISABLE_TESTS o nome do teste que deseja executar ou substituir todos eles por NONE , se realmente quiser executar todos os testes. Como alternativa, você poderia dizer a rkhunter para executar todos os testes com:
sudo rkhunter --sk --enable all --disable none