Hi, New to using Ossec, need help with use and alerts. Why doesnt OSSEC agents generate alerts if you remove directory or file listed in syscheckd configuration in ossec.conf? Other thing is that OSSEC doesnt report changes of ownership or rights for directories at all. Only for files changes are alerted.
I get a WARN in agents own ossec.log, but no alert to server alerts.log. Am I missing something here? Example piece of my configuration: <directories check_all="yes">%WINDIR%/important/important.txt</directories> or <directories check_all="yes">%WINDIR%/important</directories> Any help much appreciated! -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/groups/opt_out.
