hi, Although I have a line "<ignore type="sregex">.xdb$|.vdb$</ignore>" in the ossec servers ossec.conf, Rule 553 fires every day. (Those xdb/vdb files are AV-Signatures and change often):
Received From: (host) x.x.x.x->syscheck Rule: 553 fired (level 7) -> "File deleted. Unable to retrieve checksum." Portion of the log(s): File 'C:\Programme/SAV/VD2D1E03.vdb' was deleted. Unable to retrieve checksum. Received From: (host) x.x.x.x->syscheck Rule: 553 fired (level 7) -> "File deleted. Unable to retrieve checksum." Portion of the log(s): File 'C:\Programme/SAV/VD2D2605.XDB' was deleted. Unable to retrieve checksum. On the same server I have a sregex ignore entry which works: <ignore type="sregex">C:\WINNT/system32/Perflib_Perfdata</ignore> Why doesn't the other? It is sufficient to put the <ignore> entries into the servers ossec.conf only, ins't it? tia m
