Currently just using a <localfile> to ls -laR /dev, which might or might not be the way to go. I'll test that sometime during this week and report what I find.
Thanks, Dan. On Mon, Jun 18, 2018, 05:04 dan (ddp) <ddp...@gmail.com> wrote: > On Thu, Jun 14, 2018 at 6:43 PM, Dan Avrukin > <infernal211283.r...@gmail.com> wrote: > > Hello, > > > > Considering the nature of objects under /dev, would having a check_sum > check > > run over /dev, make it hang? > > Manually running md5sum /dev/* definitely hangs, and I'm curious if > perhaps > > syscheckd gethers its checksums in a way that it wouldn't bother it. > > > > For reference: > > <directories realtime="yes" check_sum="yes" check>/dev</directories> > > > > I haven't tried. Have you? There's too much dynamic stuff going on in /dev > these days for me to want to deal with the alerts. > > > Thanks, > > Dan. > > > > -- > > > > --- > > You received this message because you are subscribed to the Google Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send an > > email to ossec-list+unsubscr...@googlegroups.com. > > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to ossec-list+unsubscr...@googlegroups.com. > For more options, visit https://groups.google.com/d/optout. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
