OSSEC junkie wrote: > All: > > Is it possible for ossec to monitor a certain directory or file and > alert if a specific command is run? I am running OSSEC 1.6.1 right now > but if this available in the latest release, I will most certainly > upgrade. Any ideas if this is possible and if so, how do I implement this? > Thanks!
Is this 'nix? Maybe you can monitor .bash_history. Not foolproof, but maybe suitable for your needs.
