On Thu, May 20, 2010 at 4:38 AM, Adi CHIRU <[email protected]> wrote: > Hi Dan, > > 1. I have those errors on both client and server. > > 2. I have no more explicit errors in debug mode 1. > Looking at the source code I found that this message is actually a warning: > /* Avoiding wrong formats in the database. Alert about them */ > if(buf[0] == '#' || buf[0] == ' ' || buf[0] == '\n') > { > merror("%s: Invalid entry in the integrity database: '%s'", > ARGV0, buf); > continue; > } > where buf is a buffer where data retrieved from database is kept. > Obviously, some or all of this data is not in a correct format as per the > condition above. > I guess I can assume that this is quite important.. > > Also, this is a problem as from 1432 lines in the log file, 1212 line are > with this error. > > Any other ideas? > > > 3. Where can I change the default behaviour of sending 3 alerts for an event > and then starts ignoring it? > > Thanks, > > Adi > >
3. http://www.ossec.net/main/manual/manual-syscheck/ Look for auto_ignore
