[ossec-list] Real Time FIM

[Kovac]

Does the below statement work globally if put in the Management
ossec.conf, or does it have to be on each client. Assuming the same
directory on all the clients.
 
<syscheck>
<directories realtime=”yes”
check_all=”yes”>/etc,/usr/bin,/usr/sbin</directories>
 
 
 
Thank You  Christian...