I'm not sure if OSSEC ignores directories recursively. Can you try with <ignore>C:\Program files\Microsoft SQL Server\MSSQL*\LOG*</ignore>
On Fri, Jan 14, 2011 at 1:16 PM, dan (ddp) <[email protected]> wrote: > Hi Bill, > > On Fri, Jan 14, 2011 at 1:10 PM, Bill <[email protected]> wrote: > > First, my apologies if this was already answered elsewhere. I did look > but > > didn't find anything. > > > > Was anyone able to help with the ignores? I'm running into the same sort > of > > problem, and have tried multiple variations on the ignores. > > > > On Windows clients, my ossec.conf contains: > > <directories realtime="yes" check_all="yes">%ProgramFiles%</directories> > > <ignore>C:\Program files\Microsoft SQL Server\MSSQL</ignore> > > <ignore > > > type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$|^ERRORLOG</ignore> > > > > I'm not sure the example below really starts with 'ERRORLOG.' Try > removing the ^, or adding an entry for something like: > <ignore type="sregex">^C:\Program Files/Microsoft SQL > Server/MSSQL/LOG/ERRORLOG</ignore> > > > ossec.log tells me that the first line is being read but says nothing > about > > any of the ignore lines: > > 2011/01/14 10:52:13 ossec-agent: INFO: Monitoring directory: 'C:\Program > > Files'. > > > > And I still receive alerts such as this one (albeit none in realtime): > > Received From: (hostname) 99.99.99.99->syscheck > > Rule: 552 fired (level 7) -> "Integrity checksum changed again (3rd > time)." > > Portion of the log(s): > > Integrity checksum changed for: 'C:\Program Files/Microsoft SQL > > Server/MSSQL/LOG/ERRORLOG.1' > > > > Thanks, > > > > >
