Hi,
Well, that doesn't work either, as I also receive alerts about changes under: <ignore>C:\WINDOWS/PCHealth/HelpCtr/DataColl</ignore> Besides, ignore sregex *includes* those extensions that are being reported... Rui Seg, 2010-06-14 às 09:13 -0300, Daniel Cid escreveu: > Hi Rui, > > In the <ignore> section you can't specify the "*" at the end. So it should be: > > <ignore>C:\WINDOWS/System32/CCM/ServiceData/Messaging/</ignore> > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > > On Mon, Jun 14, 2010 at 7:20 AM, Rui Miguel Silva Seabra <[email protected]> wrote: > > Hello, > > > > Syscheck seems to *not* ignore some paths as instructed in the shared > > agent.conf > > > > Both the local server and agents have been restarted from the server, > > and they're both at version 2.3. We'll upgrade to 2.4 anyway, but I > > don't expect any difference as it doesn't report anything changed that > > seems related to my problem. > > > > If I am doing something wrong, can somebody clue me in, please? > > > > And now... on to more details... > > > > I have the following on my shared agent.conf that's set for all Windows > > machines: > > > > <agent_config os="Windows"> > > > > <!-- Syscheck - Integrity Checking config. --> > > <syscheck> > > > > <frequency>3600</frequency> > > > > <disabled>no</disabled> > > > > <directories check_all="yes">%SYSTEMDRIVE%/temp</directories> > > <directories check_all="yes">%WINDIR%</directories> > > <directories check_all="yes">%SYSTEMDRIVE%/hiberfil.sys</directories> > > <directories check_all="yes">%SYSTEMDRIVE%/pagefile.sys</directories> > > <directories check_all="yes">%PROGRAMFILES%</directories> > > > > <!-- Ignore these --> > > <ignore > > type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$|.msg$|.que$</ignore> > > > > <ignore>%PROGRAMFILES%/Symantec AntiVirus/SAVRT</ignore> > > <ignore>C:\WINDOWS/Temp</ignore> > > <ignore>C:\WINDOWS/System32/CCM/ServiceData/Messaging/.*</ignore> > > <ignore>C:\WINDOWS/PCHealth/HelpCtr/DataColl</ignore> > > > > </syscheck> > > > > <active-response> > > <disabled>yes</disabled> > > </active-response> > > > > </agent_config> > > > > However, I keep receiving tons of alerts for files (*.msg and *.que) > > changed , while I'd think that the following ignore rule would clear > > them: > > > > <ignore>C:\WINDOWS/System32/CCM/ServiceData/Messaging/.*</ignore> > > > > As it didn't, I added the specific msg and que extensions to the sregex > > ignore rule. Didn't work either. > > > > Thanks in advance for any help, > > Rui > > > >
