On Apr 8, 2015 9:40 AM, "Gaetan Noel" <[email protected]> wrote: > > Anyone has an idea of where I could look ? >
Does rule 555 have check_diff set? > > On Monday, April 6, 2015 at 11:11:32 AM UTC-4, Gaetan Noel wrote: >> >> Hello, >> >> We have managed to get our agentless working, the only issue I have now is the event not telling me what change has been detected. Here's a sample of that event : >> >> Alert Level: 7; Rule: 555 - Integrity checksum for agentless device changed.; Location: (ssh_pixconfig_diff) user@ip ->agentless; ossec: agentless: Change detected: >> >> It does that for all agentless devices, would you have an idea why ? >> >> Thanks, >> Gaetan > > -- > > --- > You received this message because you are subscribed to the Google Groups "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
