On Mon, Jan 27, 2014 at 4:33 AM, Bruno Andrade <[email protected]> wrote: > > Hey, that's not what I thinking. > > Lets restart... I install OSSEC, he generate file signatures, I change > a file, OSSEC trigger an alarm for that file because the signature > change. What happens now? >
That's really up to you. OSSEC doesn't really care why a file changed, it just reports that it has changed. We don't advocate handling those alerts in any particular fashion, too many groups handle it too differently for us to make those kinds of recommendations. When a file changes, the new hash will be used for the next check. If you have not turned off the auto ignore, 3 changes will make a file not be reported anymore. > Thanks. > > > -- > Bruno Andrade <[email protected]> > Programador (I&D) > Eurotux Informática, S.A. | www.eurotux.com > (t) +351 253 680 300 (m) +351 936 293 858 > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/groups/opt_out. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
