Hi Bill, On Fri, Jan 14, 2011 at 2:33 PM, Bill <[email protected]> wrote: > Recursing directories could be part of it, though I have another <ignore> > that also doesn't work for files in a specific directory. > <ignore>c:\program files\Hughes Network Systems\PDReceiver\db</ignore> > > But I receive: > > Integrity checksum changed for: 'C:\Program Files/Hughes Network > Systems/PDReceiver/db/delta.dat' > > To test with MSSQL, I added > <ignore>C:\Program files\Microsoft SQL Server\MSSQL\LOG</ignore> > <ignore>C:\Program files\Microsoft SQL Server\MSSQL\Data</ignore> > > It didn't help as I just got this (among others): > Integrity checksum changed for: 'C:\Program Files/Microsoft SQL > Server/MSSQL/Data/mentusnet.mdf' > > > > Some of my earlier tests were to correct the <ignore> for case sensitivity > and making it sregex (then escaping the backslashes & spaces). > > I didn't proceed with testing the suggestions for ERRORLOG as yet (^C:... > and ERRORLOG.* or just plain ERRORLOG). To be honest, I only had ERRORLOG > in that <ignore> trying to work around the directory ignore problem. If I > can't get the directory ignores going, I'll bet that one of those solutions > will work, they're just not ideal. (Christopher - wouldn't ERRORLOG* take > on the regex meaning of *, rather than wildcarding?) > > From everything I've searched here, it sounds like this isn't a common > problem in the field, and is likley specific to my configs or my platforms; > is that a fair assessment? > > BTW, my agents are running on Windows XP Pro, SP3. > > Thanks, to all of you. >
I recently had some issues with stubborn ignores. I'm not able to access the setup to figure out what I had to do to get it working. I think I used a brute force method by putting in multiple ignores for the same thing in multiple places. For example, to ignore /opt/nessus/var/nessus/log changes, I put something like the following in the ossec.conf on the agent (and maybe the server): <ignore type="sregex">^/opt/nessus/var/nessus/log</ignore> <ignore>/opt/nessus/var/nessus/log</ignore> I'll have to double check though.
