If you have a rule set up to alert when files are changed the changes will also be shown in the alert.
On Mon, Dec 6, 2010 at 16:17, jplee3 <[email protected]> wrote: > Hey guys, > > Is there a specific command or flag in agent_control or > syscheck_control that will display the actual changes to a file where > report_changes was set to "yes" ? > > > Or do I just have to go into the "/var/ossec/queue/diff/local/*" > directory and view the changed files myself? > > > > Thanks! -- Registered Linux User # 379282
