>Another approach would be to have OSSEC monitor for new files and then
> >have an active response which restarts the OSSEC agent. If you have a > >somewhat short syscheck scan interval then you can automatically be > >monitoring new files pretty quickly. > Michael, would you mind elaborating on this? How would I have OSSEC monitor for new files, I have not seen xml code that would allow me to do this in the agent.conf file for either <local> or <directories>. active-response can restart OSSEC? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
