Hi Bill, On Fri, Jan 14, 2011 at 1:10 PM, Bill <[email protected]> wrote: > First, my apologies if this was already answered elsewhere. I did look but > didn't find anything. > > Was anyone able to help with the ignores? I'm running into the same sort of > problem, and have tried multiple variations on the ignores. > > On Windows clients, my ossec.conf contains: > <directories realtime="yes" check_all="yes">%ProgramFiles%</directories> > <ignore>C:\Program files\Microsoft SQL Server\MSSQL</ignore> > <ignore > type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$|^ERRORLOG</ignore> >
I'm not sure the example below really starts with 'ERRORLOG.' Try removing the ^, or adding an entry for something like: <ignore type="sregex">^C:\Program Files/Microsoft SQL Server/MSSQL/LOG/ERRORLOG</ignore> > ossec.log tells me that the first line is being read but says nothing about > any of the ignore lines: > 2011/01/14 10:52:13 ossec-agent: INFO: Monitoring directory: 'C:\Program > Files'. > > And I still receive alerts such as this one (albeit none in realtime): > Received From: (hostname) 99.99.99.99->syscheck > Rule: 552 fired (level 7) -> "Integrity checksum changed again (3rd time)." > Portion of the log(s): > Integrity checksum changed for: 'C:\Program Files/Microsoft SQL > Server/MSSQL/LOG/ERRORLOG.1' > > Thanks, > >
