OK, thanks. 2012/9/25 dan (ddp) <ddp...@gmail.com>
> F we could magically associate a username with a file modification it > would be the default. > On Sep 25, 2012 6:08 AM, "Alejandro" <ajm.marti...@gmail.com> wrote: > >> Hi. >> >> I'm using ossec to monitor some windows agents on 2003 server. >> >> The server is running centos and saving the information in a mysql >> database. >> >> When I receive a syscheck event from windows (file modified, deleted or >> added) the username is empty. >> >> Is it possible to modify some rule to have that username logged on the >> event ? >> >> Thanks a lot. > >
