Hi, Have you introduced this tag inside the *syscheck *stanza of the configuration applied to the agents? It should look like this:
*<syscheck>* *...* *<nodiff>/etc/letsencrypt/live/example.com/privkey.pem <http://example.com/privkey.pem></nodiff> * *</syscheck>* Note that this configuration should be set on every endpoint where you would not like to send this information. It is possible that you are still receiving this information from agents that were not configured this way. Lastly, make sure that you have restarted the service to apply the modifications made in the configuration file. Let me know if you need anything else. On Thursday, November 7, 2019 at 6:19:02 PM UTC+1 [email protected] wrote: > Hi, > > I have configured several paths in <nodiff>...</nodiff> in the > /var/ossec/etc/ossec-server.conf. For example I have > > <nodiff>/etc/letsencrypt/live/example.com/privkey.pem</nodiff> > > Nevertheless I receive messages with changes like this > > Rule: 552 fired (level 7) -> "Integrity checksum changed again (3rd time)." > Portion of the log(s): > > Integrity checksum changed for: > '/etc/letsencrypt/live/example.com/privkey.pem' > What changed: > [...] > > I tried putting all such paths delimited with commas on one line between > one pair of <nodiff>...</nodiff> and every path on the line of its own > between its own pair <nodiff>...</nodiff>. The result is the same. > > What am I doing wrong? > > Best regards, > Michael Dukelsky > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/ossec-list/2324b07f-d410-4f48-8786-0bc3b8da4a4cn%40googlegroups.com.
