I added it but I'm must be doing it wrong. Is this how the config
should look because I get an error when I add it to rootcheck and if I
only have it in syscheck then rootcheck still runs?
<!-- Rootcheck - Policy monitor config -->
<rootcheck>
<windows_audit>./shared/win_audit_rcl.txt</windows_audit>
<windows_apps>./shared/win_applications_rcl.txt</windows_apps>
<windows_malware>./shared/win_malware_rcl.txt</windows_malware>
<scan_on_start>no</scan_on_start>
<scan_day>7</scan_day>
<scan_time>21:00</scan_time>
</rootcheck>
<!-- Syscheck - Integrity Checking config. -->
<syscheck>
<!-- Default frequency, every 18 hours. It doesn't need to be
higher
- on most systems and one a day should be enough.
-->
<scan_on_start>no</scan_on_start>
<scan_day>7</scan_day>
<scan_time>21:00</scan_time>
...
On Aug 28, 2:45 pm, "Daniel Cid" <[EMAIL PROTECTED]> wrote:
> Hey,
>
> Yes, it apply to both (rootcheck and syscheck).
>
> Thanks,
>
> --
> Daniel B. Cid
> dcid ( at ) ossec.net
>
> On Mon, Aug 25, 2008 at 3:27 PM, simpsonlang <[EMAIL PROTECTED]> wrote:
>
> > Does that also apply to rootcheck?
>
> > On Aug 25, 1:56 pm, "Daniel Cid" <[EMAIL PROTECTED]> wrote:
> >> Yes, it was added.
>
> >> -Added "scan_on_start" option to syscheck, to enable or disable the
> >> scans that are performed during the agent startup (only works when
> >> scan_time or scan_day are set).
>
> >> So, you can just set "scan_on_start" to "no" and it will only do it during
> >> the scheduled time.
>
> >> Thanks,
>
> >> --
> >> Daniel B. Cid
> >> dcid ( at ) ossec.net
>
> >> On Mon, Aug 25, 2008 at 11:23 AM, simpsonlang <[EMAIL PROTECTED]> wrote:
>
> >> > Did the config option for initial scans to be done at a later time
> >> > make it into 1.6?
>
> >> >http://marc.info/?l=ossec-list&m=121502017204912&w=2
>
> >> > On Aug 22, 8:24 pm, "Daniel Cid" <[EMAIL PROTECTED]> wrote:
> >> >> Hi list,
>
> >> >> If you would like to contribute to the project and don't know
> >> >> how,betatestingour version 1.6 might be a good way to get started.
>
> >> >> The list of new features, bug fixes and packages to use are all
> >> >> available at:http://www.ossec.net/wiki/index.php/Dev:BetaTesting
>
> >> >> These are our goals with ourbetatestingare:
>
> >> >> 1. Make sure that everything that was working on previous versions
> >> >> is still on the new one.
> >> >> 2. Make sure your local rules still work and it can parse all your
> >> >> logs.
> >> >> 3. Make sure that all the new features work as expected.
> >> >> 4. Bugs reported were properly fixed.
> >> >> 5. Make sure that the upgrade process still works on all platforms.
> >> >> 6. We need to make sure it compiles fine on all platforms and
> >> >> operating systems. Try it on Solaris, NetBSD, FreeBSD, AIX, HP-UX, any
> >> >> Linux distribution that you have.
>
> >> >> If you run into any issues, please let us know.
>
> >> >> Thanks!
>
> >> >> *from:http://www.ossec.net/dcid/?p=146
>
> >> >> --
> >> >> Daniel B. Cid
> >> >> dcid ( at ) ossec.net
