On Thu, Aug 15, 2013 at 9:04 AM, vtrack <[email protected]> wrote: >> >I forgot to make sure you modified the level of rule 554. > > > Could you please guide to how to verify and change the level of rule? I am > quite new to OSSEC and try to find the files that needs to be edited. Should > this be changed on the server or agent? Thanks. >
Agents do not do analysis, so they do not need the rules. Thankfully this question has been answered enough times that I don't feel like I should have to answer it again: http://ossec.net/doc/faq/syscheck.html#why-aren-t-new-files-creating-an-alert > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
