Re: [ossec-list] How to change the ossec default Log path?

[Christopher Moraes]

>
>
> For example,
>
> If i am changing the /etc/resolv.conf file, I want to see in the
> report/alerts who changed this file at what time?
>
>
On unix systems, have a look at auditd.  I haven't used it myself, but read
that it can keep track of who is doing what on the system.