On Jul 17, 2013 7:58 AM, "Brian Kozma" <[email protected]> wrote: > > Sorry, I'm fairly new to all of this. How do I use ignore? >
In the syscheck section, add something like: <ignore> directory </ignore> There are examples in the config. Make sure you restart ossec after the changes. > > > On Tuesday, July 16, 2013 9:44:05 AM UTC-4, dan (ddpbsd) wrote: >> >> On Tue, Jul 16, 2013 at 8:54 AM, Brian Kozma <[email protected]> wrote: >> > I have two questions about configuring OSSEC: >> > >> > 1) Can a sub folder in a parent folder be excluded from monitoring. IE if I >> > include /srv/www/checkout_app/current in the fim monitoring can I exclude >> > /srv/www/checkout_app/log from the fim monitor? >> >> Use ignore. >> >> > 2) Does the fim server follow symlinks? >> > >> >> No idea, haven't tried it. Test it out and report back. >> >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/groups/opt_out. >> > >> > > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. > > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
