In order to get the specifics, i believe you'll need to run one of the ossec reporting scripts in the bin dir. I could be mistaken but i thought i recall seeing a note on that somewhere. Sorry i don't recall the command off the top of my head. I'm sure someone will answer to this more in depth.
-----Original Message----- From: Tim Eberhard <[email protected]> Sent: Saturday, October 09, 2010 7:41 PM To: [email protected] <[email protected]> Subject: Re: [ossec-list] dev roadmap? So taking a look at report_changes I'm having some trouble figuring it out... my ossec.conf config: <!-- Directories to check (perform all possible verifications) --> <directories realtime="yes" report_changes="yes" check_all="yes">/etc</directories> <directories check_all="yes">/bin,/sbin</directories> and here is what I get: OSSEC HIDS Notification. 2010 Oct 09 19:35:14 Received From: ossec->syscheck Rule: 552 fired (level 7) -> "Integrity checksum changed again (3rd time)." Portion of the log(s): Integrity checksum changed for: '/etc/php.ini' Size changed from '45121' to '45152' Old md5sum was: 'dc26fb421dae7b52b620c386e4a3de61' New md5sum is : 'c146509741aa97cd53ef124b6b5dcd86' Old sha1sum was: '3c04c9b4072d1b0ac662f8985715de13fc9e2971' New sha1sum is : '21e6d3d31f28fa4850aa90a8ae8d5bd39a472f51' -END OF NOTIFICATION It's doing a diff, that I can tell. Looking at the diff directory I can see the changes. r...@ossec:/var/ossec/queue/diff/local/etc/php.ini# cat diff.1286675781 12c12 < ; the -c argument in command line mode. --- > ; the -c argument in command line mode. and some other stuff I had assumed there would be some kind of alert with config written into the log or emailed (I understand this can be considered insecure). Am I once again missing something obvious? Thanks again for your help, -Tim Eberhard On Sat, Oct 9, 2010 at 5:56 PM, Tim Eberhard <[email protected]> wrote: [The entire original message is not included]
