I was more interested in whether using the other check options (non-overlapping check options) would help. Still good to know though.
On Thu, Oct 14, 2010 at 4:51 AM, ItsMikeE <mernst...@gmail.com> wrote: > I tried reversing the order of directories to be monitored > > <directories check_all="yes">/application/progs</directories> > <directories check_perm="yes" check_owner="yes" check_group="yes">/ > application</directories> > > and received this alert > Received From: server4->syscheck > Rule: 550 fired (level 7) -> "Integrity checksum changed." > Portion of the log(s): > > Integrity checksum changed for: '/application/progs/progfile' > Size changed from '8' to '0' > Old md5sum was: '014ad490257f1757f32f4c106284b1e1' > New md5sum is : 'xxx' > Old sha1sum was: '3381093114df422c950657724a983a4e628fb678' > New sha1sum is : 'xxx' >
