On 06/11/2010 05:09 PM, cyberwatchers wrote:
I have added the following to the ossec.conf on the server. (using
client / server setup)
When I add a new file to the /Data directory (on another drive added
via fstab) does not alert until next rootcheck.
Hello Cyberwatchers,
That is the correct behavior for the time being. Real-time alerts for
new files being added was not implemented due to the propensity of OSes
to add and remove some files very quickly.
--
Michael Starks
[I] Immutable Security
http://www.immutablesecurity.com
