I have a new OSSEC install on a 2012r2 box and have set up on directory I
need to monitor in realtime for any changes or modifications to this one
specific folder. It does not appear to be working so any suggestions on
this would be appreciated. Here is the config from the client side 2012r2
server:
<directories check_all="yes" realtime="yes"
report_changes="yes">C:\LIS_Global_Import</directories>
Once I added this, I restarted the agent then forced the updated on the
server side:
# ./agent_control -r -u 019
I added to files into the directory being monitored and nothing, no alert,
no email, nada..
# ./syscheck_control -i 019
Integrity changes for agent 'xxxxxx (019) - x.x.x.x':
Changes for 2016 Nov 11:
2016 Nov 11 09:55:39,0 - ossec.conf
2016 Nov 11 10:08:58,0 - ossec.conf
2016 Nov 11 10:15:46,2 - ossec.conf
--
---
You received this message because you are subscribed to the Google Groups
"ossec-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to ossec-list+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
