Hi Shawn, On Fri, Jan 14, 2011 at 2:17 PM, Jefferson, Shawn <[email protected]> wrote: > Hi, > > I don't believe that will work either... wildcards like that aren't > supported in the sregex are they? > > Putting "|ERRORLOG." should ignore all files with ERROLOG. in the name, so > ERRORLOG.1, ERRORLOG.2, etc.. At least that's my understanding. >
That is correct. http://www.ossec.net/doc/syntax/regex.html explains the regex and sregex options. > ________________________________ > From: [email protected] [mailto:[email protected]] On > Behalf Of Christopher Moraes > Sent: Friday, January 14, 2011 11:06 AM > To: [email protected] > Subject: Re: [ossec-list] syscheck ignore, not actually ignoring? > >> >> >> Integrity checksum changed for: 'C:\Program Files/Microsoft SQL >> Server/MSSQL/LOG/ERRORLOG.1' > > If you want to ignore files like ERRORLOG.1, I think your regex should be > "ERRORLOG.*" > >> >> <ignore >> type="sregex">.log$|.htm$|.jpg$|.png$|.chm$|.pnf$|.evtx$|ERRORLOG.*</ignore> > > > >
