This is a feature that have been requested for a while and now is finally available. In the past, the only way to specify when rootcheck/syscheck was supposed to run was based on the frequency (every 10 hours or every 2 days, for example).
The default configuration would always look like:
<syscheck>
..
<frequency>86000</frequency>
..
</syscheck>
On version 1.5, we have two additional options: scan_time and scan_day. They allow you to run the scans on specific times or days of the week.
Example 1: Running syscheck/rootcheck every day at 11pm:
<syscheck>
..
<scan_time>23:00</scan_time>
..
</syscheck>
Example 2: Running syscheck/rootcheck tuesday, thursday and saturday at 9:30pm:
<syscheck>
..
<scan_time>9:30pm</scan_time>
<scan_day>tuesday, thursday, saturday</scan_day>
..
</syscheck>
Note that when you use scan_time and scan_day, the frequency is not going to be used. Hope you enjoy!