For e.g Under the ossec.conf at agent side, <directories check_all="yes">%WINDIR%/win.ini</directories>
I just for testing purposes edit the win.ini file and add content to it, but the ossec server doesn't not trigger any alert for this change. At the server end the <syscheck> is at default, do i have to make any changes , like tell the folder or file I want to monitor or would this be done automatically by ossec rules at server end. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
