On Thu, Dec 8, 2011 at 8:57 PM, Macus <[email protected]> wrote: > Yes, there are no files in the /var/ossec/queue/diff, but there are > files in the $HOME/abc-v123. Therefore, why there is no file in the / > var/ossec/queue/diff?? > > I add the monitor dir like below. > <directories check_all="yes">/home/abc</directories> >
Does it work if you add the report_changes option? <directories check_all="yes" report_changes="yes">/home/abc</directories> > > On 12月8日, 下午11時08分, "dan (ddp)" <[email protected]> wrote: >> On Thu, Dec 8, 2011 at 1:37 AM, Macus <[email protected]> wrote: >> > I am using the OSSEC 2.6 to monitoring a symbolic link (ie. $HOME/abc) >> > to a phy dir (ie. $HOME/abc-v123). The syscheck alert work, but in the >> > alert email, there is no diff shown for the txt file change. Moreover, >> > I found there is no image of the files stored in /var/ossec/queue/ >> > diff. >> > What's the problem? is it because the path is a symbolic link rather >> > than a phy dir? thanks >> >> Possibly. Are there no files in /var/ossec/queue/diff or just no files >> from $HOME/abc-v123?
