Try queue/diff -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of reg Sent: Thursday, October 28, 2010 9:36 AM To: ossec-list Subject: [ossec-list] Two questions
Hello, I recently updated to 2.5.1, and I have been trying to get report_changes working with syscheck. I have this working, and the alerts do contain the diff, but I am unsure where this is stored on the server. Can someone point me to where the data is stored? I tried looking in the queue/syscheck dir but the only files I saw there contained just a list of checksums. -R
