I'd like to have a definitive answer on these questions: - Does the case matter (Windows world, case doesn't usually matter.) - Does the "slash" direction matter? Windows alerts tend to have differences in the directory seperator slash direction, as illustrated below.
?? ________________________________ From: [email protected] [mailto:[email protected]] On Behalf Of Bill Sent: Friday, January 14, 2011 11:33 AM To: [email protected] Subject: Re: [ossec-list] syscheck ignore, not actually ignoring? Recursing directories could be part of it, though I have another <ignore> that also doesn't work for files in a specific directory. <ignore>c:\program files\Hughes Network Systems\PDReceiver\db</ignore> But I receive: Integrity checksum changed for: 'C:\Program Files/Hughes Network Systems/PDReceiver/db/delta.dat' To test with MSSQL, I added <ignore>C:\Program files\Microsoft SQL Server\MSSQL\LOG</ignore> <ignore>C:\Program files\Microsoft SQL Server\MSSQL\Data</ignore> It didn't help as I just got this (among others): Integrity checksum changed for: 'C:\Program Files/Microsoft SQL Server/MSSQL/Data/mentusnet.mdf' Some of my earlier tests were to correct the <ignore> for case sensitivity and making it sregex (then escaping the backslashes & spaces). I didn't proceed with testing the suggestions for ERRORLOG as yet (^C:... and ERRORLOG.* or just plain ERRORLOG). To be honest, I only had ERRORLOG in that <ignore> trying to work around the directory ignore problem. If I can't get the directory ignores going, I'll bet that one of those solutions will work, they're just not ideal. (Christopher - wouldn't ERRORLOG* take on the regex meaning of *, rather than wildcarding?) >From everything I've searched here, it sounds like this isn't a common problem >in the field, and is likley specific to my configs or my platforms; is that a >fair assessment? BTW, my agents are running on Windows XP Pro, SP3. Thanks, to all of you.
