Running v3.3.0 on the server and v3.2.0 on the client, trying to exclude *.bz2 in a given directory, I tried:
<agent_config profile="bfr"> <syscheck> <ignore type="sregex">/path/to/.bz2$</ignore> </syscheck> </agent_config> based on another post. I obviously don't understand how to do it because it's not working. /var/ossec/etc/shared/agent.conf shows the above and ossec.conf on the client has: <ossec_config> <client> <server-ip>10.22.14.11</server-ip> <config-profile>bfr, cfg, ubuntu</config-profile> </client> I've also tried the above with the qcow2 extension and get the same result. In general, how do I write an OSSEC specification to exclude all files with a given extension? Thanks for your help. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/ossec-list/6b541572-515d-4346-9fc7-cc57a5f2b76b%40googlegroups.com.