On 06/10/2010 09:31 AM, Maahkus wrote:
I want to use OSSEC for File Integrity only...I do not want to see any <syslog> messages from var/adm/messages etc...is the best way to not see these just to comment out the entry in the OSSEC.conf file? I do not want to have change any lines in the syslog.conf files...
Yes, if you simply comment out the logs that OSSEC normally monitors, you won't get alerts. You may also need to make some further modifications so you don't get rootcheck alerts, if that is your goal.
I can't help but wonder, why not get alerts from log files? I find them much more useful than integrity alerts.
-- Michael Starks [I] Immutable Security http://www.immutablesecurity.com
