[ossec-list] Re: alert_new_files does not work

[skoesters]

no one a hint for me?

i do not get the <alert_new_files>  work

On Mar 12, 6:25 pm, Sebastian Kösters <[EMAIL PROTECTED]> wrote:
> Hi again.
>
> i also have a Problem with the "alert_new_files" option.
>
> I configured it in my Server:
>
> <directories
> check_all="yes">/etc,/sbin,/bin,/usr/bin,/usr/sbin,/usr/local/bin,/usr/loca­l/sbin</directories>
>     <alert_new_files>yes</alert_new_files>  
>
> For testing i created a new file in /etc.
>
> I never got any alert for the created file but i always get a message
> when a file (allready existing) changes.
>
> Like this
>
> Integrity checksum changed for: '/etc/hosts'
> Size changed from '126' to '108'
> Old md5sum was: '5de5b1287352f8f8ceecb52566de1962'
> New md5sum is : '6575c0c69ce2acec955f990f13e14fd7'
> Old sha1sum was: 'ed1a5309ea8bca35c3f06242c679e64e4a79a819'
> New sha1sum is : '7c68ad122cde5fcf298eab0c2bc79434b0b98ba6'
>
> Some idea?
>
> Kind regards
> Sebastian