[ossec-list] syscheck ignore, not actually ignoring?

[Rui Miguel Silva Seabra]

Hello,

Syscheck seems to *not* ignore some paths as instructed in the shared
agent.conf

Both the local server and agents have been restarted from the server,
and they're both at version 2.3. We'll upgrade to 2.4 anyway, but I
don't expect any difference as it doesn't report anything changed that
seems related to my problem.

If I am doing something wrong, can somebody clue me in, please?

And now... on to more details...

I have the following on my shared agent.conf that's set for all Windows
machines:

<agent_config os="Windows">

   <!-- Syscheck - Integrity Checking config. -->
  <syscheck>

    <frequency>3600</frequency>

    <disabled>no</disabled>

    <directories check_all="yes">%SYSTEMDRIVE%/temp</directories>
    <directories check_all="yes">%WINDIR%</directories>
    <directories check_all="yes">%SYSTEMDRIVE%/hiberfil.sys</directories>
    <directories check_all="yes">%SYSTEMDRIVE%/pagefile.sys</directories>
    <directories check_all="yes">%PROGRAMFILES%</directories>

    <!-- Ignore these -->
    <ignore 
type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$|.msg$|.que$</ignore>

    <ignore>%PROGRAMFILES%/Symantec AntiVirus/SAVRT</ignore>
    <ignore>C:\WINDOWS/Temp</ignore>
    <ignore>C:\WINDOWS/System32/CCM/ServiceData/Messaging/.*</ignore>
    <ignore>C:\WINDOWS/PCHealth/HelpCtr/DataColl</ignore>

  </syscheck>

  <active-response>
    <disabled>yes</disabled>
  </active-response>

</agent_config>

However, I keep receiving tons of alerts for files (*.msg and *.que)
changed , while I'd think that the following ignore rule would clear
them:

     <ignore>C:\WINDOWS/System32/CCM/ServiceData/Messaging/.*</ignore>

As it didn't, I added the specific msg and que extensions to the sregex
ignore rule. Didn't work either.

Thanks in advance for any help,
Rui