On Thu, Dec 8, 2011 at 1:37 AM, Macus <[email protected]> wrote: > I am using the OSSEC 2.6 to monitoring a symbolic link (ie. $HOME/abc) > to a phy dir (ie. $HOME/abc-v123). The syscheck alert work, but in the > alert email, there is no diff shown for the txt file change. Moreover, > I found there is no image of the files stored in /var/ossec/queue/ > diff. > What's the problem? is it because the path is a symbolic link rather > than a phy dir? thanks
Possibly. Are there no files in /var/ossec/queue/diff or just no files from $HOME/abc-v123?
