Yes, there are no files in the /var/ossec/queue/diff, but there are files in the $HOME/abc-v123. Therefore, why there is no file in the / var/ossec/queue/diff??
I add the monitor dir like below. <directories check_all="yes">/home/abc</directories> On 12月8日, 下午11時08分, "dan (ddp)" <[email protected]> wrote: > On Thu, Dec 8, 2011 at 1:37 AM, Macus <[email protected]> wrote: > > I am using the OSSEC 2.6 to monitoring a symbolic link (ie. $HOME/abc) > > to a phy dir (ie. $HOME/abc-v123). The syscheck alert work, but in the > > alert email, there is no diff shown for the txt file change. Moreover, > > I found there is no image of the files stored in /var/ossec/queue/ > > diff. > > What's the problem? is it because the path is a symbolic link rather > > than a phy dir? thanks > > Possibly. Are there no files in /var/ossec/queue/diff or just no files > from $HOME/abc-v123?
