I'm not aware of support for seeing the diffs through agent_control.
On Mon, Dec 6, 2010 at 4:17 PM, jplee3 <[email protected]> wrote: > Hey guys, > > Is there a specific command or flag in agent_control or > syscheck_control that will display the actual changes to a file where > report_changes was set to "yes" ? > > > Or do I just have to go into the "/var/ossec/queue/diff/local/*" > directory and view the changed files myself? > > > > Thanks!
