in the OSSEC Wiki, it states auto_ignore , Specifies if syscheck will ignore files that change too often (after the third change).
I am using OSSEC 2.6 on Centos 5.3 64bit What's the mechanism of the auto ignore for a file that change too often? Does it ignore the file after the third change? How to check if a file is already ignored? I found a file was changed, but it was not reported by the OSSEC. I guest the file file was ignored automatically.
