I have a few questions about auto_ignore. We have been running ossec version 2 for a few months now and I believe that auto_ignore is enabled by default? If so, I can disable by adding the following inside the <syscheck> configuration part of the ossec.conf file on the ossec server, correct: <auto_ignore>no</auto_ignore>
Is there a way to view what is currently been added to the auto ignore list? Also, is there a way to reset this list for all clients? Aaron
