findings update to rule 533 not firing ... I can get deletions to alert ONLY if running inotify. From what I can see the implementation is not what it seems ... (or I might be totally wrong)
syscheck runs and passes on a list of information to analysisd i.e. filename, hash etc analysisd loops through the db and matches up supplied file details with what it has in db ... and take needed action etc analysisd dips into a function called ... DB_Search(char *f_name, char *c_sum, Eventinfo *lf) So for this function to run we need to supply it with some file data .. if the file data was not supplied i.e. was deleted then syscheck does not supply it and hence the function which has the deletion check does not run. BUT if real-time i.e. inotify is enabled then the deletion is trapped and the file details passed to the function which catches the fact that certain bits of detail are missing and therefore file is assumed deleted ... FIRE IN THE HOLE ... 533 triggered. What we need is a function that looks at the db after all the initial checks and works out what it has in the db that did not get matching file details? i.e. no update/lookup attempt ... it might be there and i cant see it? /nick
