Ok, thank you for your help :) Sue
On Monday, November 26, 2012 12:43:30 PM UTC-6, dan (ddpbsd) wrote: > > On Mon, Nov 26, 2012 at 12:48 PM, Sue <[email protected] <javascript:>> > wrote: > > Thanks for your consideration. Without the report_changes option can I > still > > get an alert if there is a diff in a file? Using a rule perhaps? If so, > how > > do I go about seeing what the change was? > > > > You will still get alerts that a file has changed, but will not get > the diff. In order to get the diff, a copy of the file has to be kept > somewhere. I guess your other option (besides modifying the source), > would be to use an appropriately sized partition. > >
