Hi Marco,
You can have the "ignore" on both the server or the agent (depending if you want it to be globally or locally applied). The following thread has some information: http://www.ossec.net/ossec-list/2007-March/msg00150.html Regarding syscheck_update, it basically resets the file integrity database for a specific system. Hope it helps. -- Daniel B. Cid dcid ( at ) ossec.net On 3/18/07, Marco Supino <[EMAIL PROTECTED]> wrote:
Hi, When adding <ignore> to ossec, should it be on the agent or on the server ? Also, what does syscheck_update do ? Marco.
