Hi, I don't believe that will work either... wildcards like that aren't supported in the sregex are they?
Putting "|ERRORLOG." should ignore all files with ERROLOG. in the name, so ERRORLOG.1, ERRORLOG.2, etc.. At least that's my understanding. ________________________________ From: [email protected] [mailto:[email protected]] On Behalf Of Christopher Moraes Sent: Friday, January 14, 2011 11:06 AM To: [email protected] Subject: Re: [ossec-list] syscheck ignore, not actually ignoring? Integrity checksum changed for: 'C:\Program Files/Microsoft SQL Server/MSSQL/LOG/ERRORLOG.1' If you want to ignore files like ERRORLOG.1, I think your regex should be "ERRORLOG.*" <ignore type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$|ERRORLOG.*</ignore>
