First, my apologies if this was already answered elsewhere. I did look but didn't find anything.
Was anyone able to help with the ignores? I'm running into the same sort of problem, and have tried multiple variations on the ignores. On Windows clients, my ossec.conf contains: <directories realtime="yes" check_all="yes">%ProgramFiles%</directories> <ignore>C:\Program files\Microsoft SQL Server\MSSQL</ignore> <ignore type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$|^ERRORLOG</ignore> ossec.log tells me that the first line is being read but says nothing about any of the ignore lines: 2011/01/14 10:52:13 ossec-agent: INFO: Monitoring directory: 'C:\Program Files'. And I still receive alerts such as this one (albeit none in realtime): Received From: (hostname) 99.99.99.99->syscheck Rule: 552 fired (level 7) -> "Integrity checksum changed again (3rd time)." Portion of the log(s): Integrity checksum changed for: 'C:\Program Files/Microsoft SQL Server/MSSQL/LOG/ERRORLOG.1' Thanks,
