The Starting messages are just from syscheck starting up and creating the initial scan.
On Fri, Mar 4, 2011 at 4:59 PM, satish patel <[email protected]> wrote: > What is pre-scan thing ? what exactly its doing there after forwarding > database. > > # tail -f /var/ossec/logs/ossec.log > > 2011/03/04 13:55:11 ossec-rootcheck: INFO: Starting rootcheck scan. > 2011/03/04 13:58:26 ossec-rootcheck: INFO: Ending rootcheck scan. > 2011/03/04 13:58:46 ossec-syscheckd: INFO: Starting syscheck scan > (forwarding database). > 2011/03/04 13:58:46 ossec-syscheckd: INFO: Starting syscheck database > (pre-scan). >
