Dan, I would like to note that I have never seen a file deleted event fired without realtime=true.
I have also verified it by deleting a file when ossec agent was down. This file was never reported as deleted again even after full scans (unlike new files / updated file - that were reported after the full scan) If you can see file deleted event in a non realtime configuration - please share. Thanks, Roy On Tuesday, October 1, 2013 6:36:06 AM UTC-7, dan (ddpbsd) wrote: > > On Tue, Oct 1, 2013 at 2:31 AM, vtrack <[email protected] <javascript:>> > wrote: > > Hello, > > > > I would like to know the features we can use with enabling realtime=yes > for > > each monitored directory. Is that just for file deletion alerts? > > > > It should detect all file changes, just like a non-realtime syscheck scan. > > > I think each agent machines should also have inotify-tools and > > inotify-tools-devel installed. I did some tests with real time but did > not > > get alerts for file deletion. I did wait for a syscheck scan to run on > the > > agent system. Is there a way to check if inotify-tools are working fine? > > > > Thanks. > > > > -- > > > > --- > > You received this message because you are subscribed to the Google > Groups > > "ossec-list" group. > > To unsubscribe from this group and stop receiving emails from it, send > an > > email to [email protected] <javascript:>. > > For more options, visit https://groups.google.com/groups/opt_out. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
