On Fri, Jan 14, 2011 at 2:05 PM, Christopher Moraes <[email protected]> wrote: >> >> >> Integrity checksum changed for: 'C:\Program Files/Microsoft SQL >> Server/MSSQL/LOG/ERRORLOG.1' > > If you want to ignore files like ERRORLOG.1, I think your regex should be > "ERRORLOG.*" >
sregex does not support '*": http://www.ossec.net/doc/syntax/regex.html >> >> <ignore >> type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$|ERRORLOG.*</ignore> > > > >
