On Wed, Oct 1, 2014 at 2:43 PM, Macaulay Dias Souza <[email protected]> wrote: > Hi Dan, in my tests alerts always stop after the third amendment. It's > something I forgot to do? My installation was standard and the only thing > changed is a rule to raise the level according to the location where the > SysCheck found something >
Sounds like the auto ignore. Turn that off. Try again. > Em sexta-feira, 12 de setembro de 2014 16h47min26s UTC-3, dan (ddpbsd) > escreveu: >> >> On Fri, Sep 12, 2014 at 3:36 PM, Macaulay Dias Souza >> <[email protected]> wrote: >> > Hi, I found this in this group: >> > >> > https://groups.google.com/forum/?hl=pt-BR#!searchin/ossec-list/Integrity$20checksum$20changed.$203$20times/ossec-list/qk8Ch6DEIqk/6LCqilsDoJEJ >> > >> > I think this is no more a bug, but is possible to configure OSSEC to >> > stop >> > ignoring it? >> > >> > >> > If I need change any file, can help me? >> > >> >> Are you trying to turn off the auto ignore? That feature's been >> available for a long time now. If you want to reset the data, one of >> the syscheck binaries in /var/ossec/bin does that. >> >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> > Groups >> > "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> > an >> > email to [email protected]. >> > For more options, visit https://groups.google.com/d/optout. > > -- > > --- > You received this message because you are subscribed to the Google Groups > "ossec-list" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
