Greetings Daniel:
Has upgrading been fixed so that if you want to update rules, BUT keep
your rule exclusions in /var/ossec/etc/ossec.conf your exclusions are
not clobbered?
i.e.
<!--
<include>arpwatch_rules.xml</include>
<include>symantec-av_rules.xml</include>
<include>symantec-ws_rules.xml</include>
-->
Where the above three rules are excluded in ossec.conf. Upgrading
ossec clobbers the above changes; and yet, we don't want to say no to
rule upgrades because there may be updates to rules we do use.
Please advise.
Thank you.
