On Wed, Mar 1, 2017 at 11:10 AM, Dominik <reusser...@gmail.com> wrote: > OSSEC creates checksums and chained checksums of the archives. I need a way > to confirm that the chain is correct. > > zcat /var/ossec/logs/archives/2017/Feb/ossec-archive-28.log.gz | md5sum > creates the entry > Current checksum: > MD5 (/logs/archives/2017/Feb/ossec-archive-28.log) = > in ossec-archive-28.log.sum > > Likewise > zcat /var/ossec/logs/archives/2017/Feb/ossec-archive-27.log.sum | md5sum > creates the entry > Chained checksum: > MD5 (/logs/archives/2017/Feb/ossec-archive-28.log) = > in ossec-archive-28.log.sum > > I could create a script to do the check all the way to the beginning. > > Does OSSEC provide a method to do this check without scripting it? > > I was not able to find that in the documentation (probably checking at the > wrong place) >
I don't believe we have a script or anything to check that. > Thanks > Dominik > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
