Hello pRose I think that if you modify "by hand" a file in a debian package installation file (as ossec.conf for example) the uninstall process doesn't completely remove the folder. Could you please try to re-do your uninstall process and then, verify if the folder "/var/ossec" still appearing? If yes, you could remove it by "rm -rf /var/ossec/".
Best regards, Alberto R. On Tuesday, July 11, 2017 at 1:55:15 AM UTC+2, pRose wrote: > > i am attempting to purge and start from scratch with my ossec install. > > i have uninstalled previously using apt: > > sudo apt remove --purge ossec-hids-server > > i have then removed all files and users associated with ossec: > > sudo rm -f /etc/init.d/ossec /etc/rc0.d/K20ossec /etc/rc1.d/K20ossec > /etc/rc2.d/S20ossec /etc/rc3.d/S20ossec /etc/rc4.d/S20ossec > /etc/rc5.d/S20ossec /etc/rc6.d/K20ossec; sudo rm -rf /var/ossec; sudo > /usr/sbin/deluser ossec; sudo /usr/sbin/deluser ossecm; sudo > /usr/sbin/deluser ossecr; sudo /usr/sbin/deluser ossecd; sudo > /usr/sbin/delgroup ossec; sudo /usr/sbin/delgroup ossecd > > my /etc/apt/sources.list.d/atomic.list > > has the following: > > 1 deb https://updates.atomicorp.com/channels/atomic/debian jessie main > > i am running debian 8.8. > > now when i install using apt: > > apt install ossec-hids-server > > it works, however the file: > > /var/ossec/etc/ossec.conf > > gets recreated from the previous version, when i would just like to see > the default. the global section containing various email configs are > definitely from the old version, and frankly i have no idea how they could > have gotten there. > > appreciate any help on this issue. > > thanks. > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
