I have added the following to the ossec.conf on the server. (using
client / server setup)
<syscheck>
<!-- Frequency that syscheck is executed - default to every 22
hours -->
<frequency>79200</frequency>
<alert_new_files>yes</alert_new_files>
<auto_ignore>no</auto_ignore>
<!-- Directories to check (perform all possible verifications) --
>
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
<directories check_all="yes">/bin,/sbin</directories>
<directories realtime="yes" check_all="yes">/Data</directories>
When I add a new file to the /Data directory (on another drive added
via fstab) does not alert until next rootcheck.
My Local rules I added.
<group
name="local,syslog,proftpd,invalid_login,connection_attempt,authentication_success,authentication_failed,syscheck">
(not sure if I need to add all the groups here or directly to the
rule..)
<!-- New File Added -->
<rule id="554" level="7" overwrite="yes">
<category>ossec</category>
<decoded_as>syscheck_new_entry</decoded_as>
<description>File added to the system.</description>
</rule>
I monitor the alerts real time via tail -f alerts however nothing
seen. Any help would be great. Thanks.
