Since /dev contains a special filesystem which cannot
be used for "simple" files and directories, I would say
that the IDS needs some knowledge about it and generic
file-checking rules don't apply there.
This sounds like a false alert, something must have changed
from 8 to 9 and/or the ossec port (and/or ossec signatures).
Disclaimer: I am not an ossec user!
Nikos
On 11/24/2011 11:04 AM, Odhiambo Washington wrote:
Getting the same too, since I upgraded my 8.2 -> 9.0-PRE.
Would be interested in the answers too.
On Thu, Nov 24, 2011 at 10:32, Ross<basarev...@gmail.com> wrote:
I am getting emails about hidden files in /dev. Before that (on 8.2)
everything was OK. What should I do?
OSSEC HIDS Notification.
2011 Nov 24 08:17:25
Received From: coffin->rootcheck
Rule: 510 fired (level 7) -> "Host-based anomaly detection event
(rootcheck)."
Portion of the log(s):
Files hidden inside directory '/dev'. Link count does not match number
of files (9,27).
--END OF NOTIFICATION
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "
freebsd-questions-unsubscr...@freebsd.org"
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
