On Tue, 5 Oct 2010 21:23:03 -0400, Chris Decker <[email protected]> wrote: > A quick update: > - The new Snapshot released today (which appears to be destined to be the > 2.5.1 release) does not fix my problem as noted below. > - I was re-reading the documentation and noticed this statement: "Real time > only works with directories, not individual files. So you can monitor the > /etc or C:program files directory, but not an individual file like > /etc/file.txt.". I knew this already, but tried my configuration with > realtime disabled and still experience this issue.
Are these new installs or upgrades? Strange that you seem to be the only one reporting this so far. I am running it on CentOS 5.5 and am not having any issues. And you also experience OSSEC crashing with just regular syscheck and not realtime enabled, but with report_changes enabled? -- [I] Immutable Security Information Security, Privacy and Personal Liberty http://www.immutablesecurity.com
