I tried reversing the order of directories to be monitored
<directories check_all="yes">/application/progs</directories>
<directories check_perm="yes" check_owner="yes" check_group="yes">/
application</directories>
and received this alert
Received From: server4->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):
Integrity checksum changed for: '/application/progs/progfile'
Size changed from '8' to '0'
Old md5sum was: '014ad490257f1757f32f4c106284b1e1'
New md5sum is : 'xxx'
Old sha1sum was: '3381093114df422c950657724a983a4e628fb678'
New sha1sum is : 'xxx'
