Looks like there is a frequency option under rootcheck http://www.ossec.net/main/manual/configuration-options/#rootcheck_options
I had specified "scan on start" as "no" under the rootcheck option and did this in the agent.conf. Went ahead and removed that though and will monitor again to see if it kicks off - if it does, that means agent.conf isn't pushing the option. Then I'll have to try placing the rootcheck frequency flag in the ossec.conf. On Sat, Oct 2, 2010 at 6:12 AM, Jeremy Lee <[email protected]> wrote: > Any idea why rootcheck would kick off on its own in that case? I tried > setting <frequency> under <rootcheck> to the same as what I have for > <syscheck> to no avail. The rootcheck process kicked off again in the > morning. > > > On Fri, Oct 1, 2010 at 12:06 PM, dan (ddp) <[email protected]> wrote: > >> On Fri, Oct 1, 2010 at 2:01 PM, jplee3 <[email protected]> wrote: >> > One other question: are there separate options for scheduling >> > rootcheck? It seems syscheck is on the correct schedule, however, I >> > noticed this morning that all my agents kicked off rootcheck processes >> > at the same time. >> > >> >> I'm not aware of any options to modify rootcheck's schedule. Try it and >> see. >> > >
