On Tue, Mar 2, 2010 at 3:04 AM, rob <[email protected]> wrote: > Hi > > I would like to be able to schedule scans with OSSEC rather than use > the frequency. I would like the scans only to run once a week at > scheduled time currently. At a later stage I may change this > frequency to once an hour but for now the requirement is once a week. > > Can you give me guidance on how to do this? > > Thank you > > Rob >
For syscheck you can use the <scan_time> and <scan_day> option. I'm not sure if setting frequency to 0 or something would stop it from running. You might be able to disable the rootcheck scan in the ossec.conf and run it via cron or something, but I haven't tried that.
