Hello ossec gurus, I was wondering if it is possible to force the execution of a full-capacity re-scan of the files' checksum DB.
Basically, when preforming system maintenance on a per-server basis, I'd like to be able to: 1) turn off ossec and disable alerting for this box in ossec.conf 2) update the box with our current application version (modifying monitored files and, thus, altering their checksums) 3) issue a fast-as-possible rescan of the files on the server (generate checksums of the new files), and 4) restart ossec with alerting re-enabled Ideally, the only alerts that I will receive after this process are: "ossec agent disconnected" and "ossec agent connected" The problem with this is: normally, ossec-syscheckd would be niced *way* down so that #3 above would take an unreasonably high amount of time. Is there a way to make it a #1 priority? Cheers, Michael Altfield
