Thanks Daniel! I'll try it out. Is it possible to utilize the realtime flag for rootcheck monitoring though?
I'd be interested in tracking changes live. On Wed, Jun 15, 2011 at 11:32 AM, Daniel Cid <[email protected]> wrote: > /var/ossec/etc/shared/system_audit_rcl.txt >
