On Tue, May 8, 2012 at 1:10 PM, Sun Poon <[email protected]> wrote: > That might be the reason to the problem. But how about the missed > alert cases? I wonder if problem would occur if I set the frequency to > high :/ But my boss insist on making this "real-time". >
I haven't had an issue with that. Is there any commonality? Is it the same files that aren't generating alerts? Are they in the database? Have they alerted at all? You set auto ignore to no on the manager, right? And restarted the OSSEC processes? > On May 9, 1:05 am, "dan (ddp)" <[email protected]> wrote: >> On Tue, May 8, 2012 at 12:57 PM, Sun Poon <[email protected]> wrote: >> > It's around 11 minutes according to the log. >> >> Perhaps the <frequency>900</frequency> begins counting after the >> completion of the previous scan? >> >> >> >> >> >> >> >> >> >> > On Wednesday, May 9, 2012 12:50:31 AM UTC+8, dan (ddpbsd) wrote: >> >> >> On Tue, May 8, 2012 at 12:24 PM, Sun Poon <[email protected]> wrote: >> >> > Dear Sir/Madam, >> >> >> > I deployed OSSEC as a HIDS agent to a big old system (SUSE 9 without >> >> > inotify) in our company. Being required by my boss, it is essential >> >> > for me to report critical file changes ASAP to various system owners. >> >> >> > With the limitation, I decided to use frequent syscheck to replace the >> >> > real-time features. I set the frequency to <frequency>900</frequency>, >> >> > I have also disabled the auto-ignore feature. However, it is >> >> > discovered that the file change event appears 30 minutes later, or >> >> > even not showing up. I have checked that the database is not empty by >> >> > using ossec-wui. Is there any configuration error I have made? >> >> >> > Best Regards, >> >> > Sun >> >> >> How long does a scan take? I can't imagine a scan of any decent size >> >> taking less than 900 seconds.
