This is a re-post since it looks like my first post get lost somewhere. I've tried to edit "ossec.conf" file in /var/ossec/etc but was not allowed to save changes.
Before editing the file I had stopped OSSEC executing "sudo /etc/init.d/ossec stop". Then tried both "gksudo gedit /var/ossec/etc/ossec.conf" and "sudo -s" and then as root tried to edit the file. In both cases in Gedit I get Save option disabled with no way to save changes. In Vim I was prompted for an attempt to save a read-only file and then bash reported an error. It look obvious to me that OSSEC rightfully protects its files and this is the problem. Thus I'm not looking for a work around (like removing read-only attrib, etc.) but rather for the right way to do things. But so far I've not found anything related to the case in OSSEC's documentation and wiki. Could anybody help, please?
