Interesting idea. I'm not sure how the server would handle that exactly. It might work, it might not...
I've also chatted with people that run multiple instances of OSSEC on their systems. Usually syscheck is disabled in one or the other, but I guess it's possible to run 2 instances of OSSEC only doing syscheck in the second one. Set up the instances as different agents on the manager (using CIDR addresses for the IP addresses), so there will be different keys for each OSSEC instance. I haven't tried any of that, so no blaming me if it doesn't work. ;) On Wed, Dec 8, 2010 at 4:22 PM, Christopher Moraes <[email protected]> wrote: > syscheck has a "-c" option to specify a config file when it is run. > You can try setting up a cron job that will run syscheck every 3 hours and > specify a control file that contains the list of the 3 files you want to > check.  Put the other files in the ossec.conf file. > Just a thought, I haven't tried this. > > On Wed, Dec 8, 2010 at 3:57 PM, tanishk lakhaani <[email protected]> > wrote: >> >> Hi People !!! >> >> Can we tweak OSSEC to run integrity checking for different file fat >> different instances. I mean to say: suppose I have 6 files to monitor for >> Integrity checking…. I want that the integrity checking on 3 of them to be >> in every 3 hours, whereas for the rest to be every 10 hours. >> >> >> >> Any idea, if I can tweak it like this. >> >> >> >> Regards >> >> Tanishk >
