Hi there, Welcome!
It sounds like you want to do some integrity checking to notify you of any changes to files in the C:\Test_TPS directory, correct? If so, it should be pretty straightforward. You just need to edit the ossec.conf (/var/ossec/etc/ossec.conf is the default path on your OSSEC server) and add the following under the <syscheck> section: <directories check_all="yes">C:\Test_TPS</directories> Hope that helps! --Jeremy On Wed, Sep 15, 2010 at 1:22 PM, Aamir Niazi <[email protected]> wrote: > Hello List, My first time writing to this list. > > I have OSSEC running on Ubuntu 10.4 and have windows client machines. > There is not much on the website regarding rules so I purchased the > OSSEC book. But I am still confused about how to you custom write > rules to monitor specific directories. Lets say if I wanted to monitor > C:\Test_TPS folder and files within this directory on the windows > machine, what would I have to do in order to make sure that client is > configured for this and server is also monitoring this directory for > any changes and integrity? If anyone can elaborate a little bit on > this I would highly appreciate it. FYI i am a *nix newbie. > > Thanks a lot in advance. > > -- > Best Regards, > > Aamir Niazi >
