Hi Rui, In the <ignore> section you can't specify the "*" at the end. So it should be:
<ignore>C:\WINDOWS/System32/CCM/ServiceData/Messaging/</ignore> Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Mon, Jun 14, 2010 at 7:20 AM, Rui Miguel Silva Seabra <[email protected]> wrote: > Hello, > > Syscheck seems to *not* ignore some paths as instructed in the shared > agent.conf > > Both the local server and agents have been restarted from the server, > and they're both at version 2.3. We'll upgrade to 2.4 anyway, but I > don't expect any difference as it doesn't report anything changed that > seems related to my problem. > > If I am doing something wrong, can somebody clue me in, please? > > And now... on to more details... > > I have the following on my shared agent.conf that's set for all Windows > machines: > > <agent_config os="Windows"> > > <!-- Syscheck - Integrity Checking config. --> > <syscheck> > > <frequency>3600</frequency> > > <disabled>no</disabled> > > <directories check_all="yes">%SYSTEMDRIVE%/temp</directories> > <directories check_all="yes">%WINDIR%</directories> > <directories check_all="yes">%SYSTEMDRIVE%/hiberfil.sys</directories> > <directories check_all="yes">%SYSTEMDRIVE%/pagefile.sys</directories> > <directories check_all="yes">%PROGRAMFILES%</directories> > > <!-- Ignore these --> > <ignore > type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$|.msg$|.que$</ignore> > > <ignore>%PROGRAMFILES%/Symantec AntiVirus/SAVRT</ignore> > <ignore>C:\WINDOWS/Temp</ignore> > <ignore>C:\WINDOWS/System32/CCM/ServiceData/Messaging/.*</ignore> > <ignore>C:\WINDOWS/PCHealth/HelpCtr/DataColl</ignore> > > </syscheck> > > <active-response> > <disabled>yes</disabled> > </active-response> > > </agent_config> > > However, I keep receiving tons of alerts for files (*.msg and *.que) > changed , while I'd think that the following ignore rule would clear > them: > > <ignore>C:\WINDOWS/System32/CCM/ServiceData/Messaging/.*</ignore> > > As it didn't, I added the specific msg and que extensions to the sregex > ignore rule. Didn't work either. > > Thanks in advance for any help, > Rui > >
