Couldn't find anything about this is the archives, I started the agent and about 10 minutes later got an email with about 100 files listed as being new. The first 20 were in /usr/share/i18n/locales and I looked at about the first 10. Using stat to display the access/modify/change time stamps for all files in the directory and sorting the list, as best as I can tell, all files in the directory (338 total) were accessed after starting the agent but only 20 surfaced as being new files. Scanning through the list, it appears that all change dates are 8/14/17 and all modification dates are 6/16/17 (I individually checked some of those reported as new files).
Any ideas? Anything i need to post? Thanks for the help. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
