It is exactly what is happening. The volume is checked is every client, with obvious negative effects.
On Wed, Jun 13, 2012 at 11:58 AM, dan (ddp) <[email protected]> wrote: > On Wed, Jun 13, 2012 at 10:44 AM, Wilson Ricardo <[email protected]> > wrote: >> Hi, >> >> I configured the ossec.conf to ignore the mounted volumes, but the >> ossec is still checking nfs volumes. >> ossec.conf: >> >> <syscheck> >> <!-- Frequency that syscheck is executed - default to every 22 hours --> >> <frequency>79200</frequency> >> >> <!-- Directories to check (perform all possible verifications) --> >> <directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories> >> <directories check_all="yes">/bin,/sbin</directories> >> >> <!-- Files/directories to ignore --> >> <ignore>/etc/mtab</ignore> >> <ignore>/etc/mnttab</ignore> >> <ignore>/etc/hosts.deny</ignore> >> <ignore>/etc/mail/statistics</ignore> >> <ignore>/etc/random-seed</ignore> >> <ignore>/etc/adjtime</ignore> >> <ignore>/etc/httpd/logs</ignore> >> <ignore>/etc/utmpx</ignore> >> <ignore>/etc/wtmpx</ignore> >> <ignore>/etc/cups/certs</ignore> >> <ignore>/etc/dumpdates</ignore> >> <ignore>/etc/prelink.cache</ignore> >> <ignore>/etc/svc/volatile</ignore> >> <ignore>/usr/bin/inotifywait</ignore> >> <ignore>/usr/bin/inotifywatch</ignore> >> <ignore type="sregex">/var/www*</ignore> >> (...) >> >> <rootcheck> >> <rootkit_files>/var/ossec//etc/shared/rootkit_files.txt</rootkit_files> >> >> <rootkit_trojans>/var/ossec//etc/shared/rootkit_trojans.txt</rootkit_trojans> >> <system_audit>/var/ossec//etc/shared/system_audit_rcl.txt</system_audit> >> <system_audit>/var/ossec//etc/shared/cis_rhel_linux_rcl.txt</system_audit> >> >> <system_audit>/var/ossec//etc/shared/cis_rhel5_linux_rcl.txt</system_audit> >> <ignore type="sregex">/var/www*</ignore> >> </rootcheck> >> >> Versions: >> ossec-hids-client-2.6-12.el5.art >> ossec-hids-2.6-12.el5.art >> Linux img02 2.6.18-194.3.1.el5 #1 SMP Thu May 13 13:08:30 EDT 2010 >> x86_64 x86_64 x86_64 GNU/Linux >> CentOS release 5.5 (Final) >> >> Mount points: >> [root@img02 ~]# mount >> /dev/sdb1 on / type ext3 (rw) >> proc on /proc type proc (rw) >> sysfs on /sys type sysfs (rw) >> devpts on /dev/pts type devpts (rw,gid=5,mode=620) >> /dev/sdb5 on /tmp type ext3 (rw) >> /dev/sda1 on /boot type ext3 (rw) >> tmpfs on /dev/shm type tmpfs (rw) >> none on /proc/sys/fs/binfmt_misc type binfmt_misc (rw) >> sunrpc on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw) >> IP:/vol2/db_files/xml/galerias on /var/www/html/galerias type nfs >> (ro,rsize=32768,wsize=32768) >> IP:/vol2/mm_files/fotos on /var/www/html/fotos type nfs >> (ro,rsize=32768,wsize=32768) >> IP:/vol4/ on /var/www/vol4 type nfs (rw,rsize=32768,wsize=32768) >> (...) >> >> I already tried <ignore>/var/www</ignore>, and tried to ignore every >> mount point creating one <ignore> each one. >> >> What am I missing? >> >> Thank you. > > It doesn't even look like you have a <directories> setup for > /var(/www). So I'm not sure why it would be checking it in the first > place. > > But I don't think ignore works like everyone thinks it does. It still > checks everything, just ignores the results.
