I have installed OSSEC, other functions normally. But the newly added files
and folders can not be reminded, how to set?
Server Software version: OSSEC 2.8
Server System Version: CENTOS6.4 Agent Version: CENTOS6.4
I configured according to the documentation:
http://ossec-docs.readthedocs.org/en/latest/manual/syscheck/index.html
My method:
1, the increase in local_rules.xml
<rule id="554" level="12" overwrite="yes">
<category>ossec</category>
<decoded_as>syscheck_new_entry</decoded_as>
<description>File added to the system.</description>
<group>syscheck,</group>
</rule>
2, an increase in the agent side ossoec.conf
<syscheck>
<frequency>20</frequency>
<alert_new_files>yes</alert_new_files>
<directories check_all="yes">/var/www</directories>
<ignore>/ett/mtab</ignore>
</syscheck>
3, Scan now
/opt/ossec/bin/agent_control -r -u 001
/opt/ossec/bin/agent_control -lc (Show has been updated)
But monitoring page see any relevant records also receive mail
You received this message because you are subscribed to the Google Groups "ossec-list" group.
For more options, visit https://groups.google.com/d/optout.
and folders can not be reminded, how to set?
Server Software version: OSSEC 2.8
Server System Version: CENTOS6.4 Agent Version: CENTOS6.4
I configured according to the documentation:
http://ossec-docs.readthedocs.org/en/latest/manual/syscheck/index.html
My method:
1, the increase in local_rules.xml
<rule id="554" level="12" overwrite="yes">
<category>ossec</category>
<decoded_as>syscheck_new_entry</decoded_as>
<description>File added to the system.</description>
<group>syscheck,</group>
</rule>
2, an increase in the agent side ossoec.conf
<syscheck>
<frequency>20</frequency>
<alert_new_files>yes</alert_new_files>
<directories check_all="yes">/var/www</directories>
<ignore>/ett/mtab</ignore>
</syscheck>
3, Scan now
/opt/ossec/bin/agent_control -r -u 001
/opt/ossec/bin/agent_control -lc (Show has been updated)
But monitoring page see any relevant records also receive mail
You received this message because you are subscribed to the Google Groups "ossec-list" group.
For more options, visit https://groups.google.com/d/optout.