On Mon, Oct 11, 2010 at 8:36 AM, Rich Rumble <[email protected]> wrote: > > Showing a diff on a file's contents logistically sounds tough, you'd > need a copy of the previous file, and large files would likely be out > of reach... some limit would need to be imposed. Then where do you > store the copy of the old file, the old registry key, the old hosts > file... on the server, on the client? To me, while I want the feature, > I'm not sure people realize the trade off they need to make, mainly > client disk space so copies of originals (even if compressed) can be > stored and the diff's can be made. Diskspace is cheap and this might > not be an issue for some, but we run a lot of VM and the guests are > only as big as they need to be, the "free" space we have is for > anticipated growth, we may have to add to those estimates and grow our > previous installs:) > > -rich >
This feature is already available for unix systems. Look at the report_changes section: http://www.ossec.net/doc/manual/syscheck/index.html
