Hi. Syscheck doesn't monitor inode changes on files at the present. In fact I don't know a way to change the inode number without modifying it.
When a file is renamed, it keeps the inode, but if it's deleted, when you eventually create a new one, with the same or different name, the operating system can assign the inode of the same file (as Linux does) or create always a different inode (as OS X does). This is a way to change an inode and OSSEC doesn't notify about it: $ touch test.txt (OSSEC fires rule 554, if enabled) $ cp test.txt copy.txt && rm test.txt && mv copy.txt test.txt In this case, the inode has changed, but since neither the size nor the content of the file have changed, OSSEC doen't detect it. Could you give us an use case in which it would be interesting to detect inode changes? Kind regards. Victor Fernandez. On Wednesday, June 29, 2016 at 1:30:33 PM UTC-7, Kumar Mg wrote: > > Hi Dan, > > I am referring to have inode alerts similar way we have the MD5 alerts > from syscheck. > > > Thanks > Kumar > > > On Thursday, 30 June 2016, dan (ddp) <ddp...@gmail.com <javascript:>> > wrote: > >> >> On Jun 29, 2016 4:24 PM, "Kumar Mg" <mkg...@gmail.com> wrote: >> > >> > Hi, >> > >> > Is there a way we can have Syscheck to alert the inode changes >> separately. >> > >> > >> >> Is there a rule specifically for inode changes? If so, it should be easy >> (depending on what you mean exactly). >> >> > Thanks >> > Kumar >> > >> > -- >> > >> > --- >> > You received this message because you are subscribed to the Google >> Groups "ossec-list" group. >> > To unsubscribe from this group and stop receiving emails from it, send >> an email to ossec-list+unsubscr...@googlegroups.com. >> > For more options, visit https://groups.google.com/d/optout. >> >> -- >> >> --- >> You received this message because you are subscribed to the Google Groups >> "ossec-list" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to ossec-list+unsubscr...@googlegroups.com. >> For more options, visit https://groups.google.com/d/optout. >> > -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
