[ossec-list] report_changes - odd results

2012-02-13 Thread Kat
Hi all..

Here is an odd one. I have a folder with a few dozen subfolders. I
want to set up "report_changes" on all the subfolders with a specific
file in it - for example:

/opt/conf/*/*act_config

And it seems to work fine - but here is the odd part. The *sh_config
is a txt file in every folder, and this is verified. Sometimes the
report changes actually works and other times it only shows the
checksums changing, which I know if the checksum changes the contents
had to change.

So the question is simple -- any idea what might cause the
report_changes to work most of the time, but sometimes it only reports
checksum? How would you debug this?

Basically I have a system with 50-60 users and they each have one of
the config files and they change them from time to time. So I want to
know which user changed it and what the changed (so when they say "I
didn't change anything" I can tell them and show them.  But the
baffling part is this works 90% of the time, but every now and then,
as mentioned, it does not show the actual changes.

signed,
confused...


Re: [ossec-list] report_changes - odd results

2012-02-14 Thread dan (ddp)
I don't know of a specific way to debug this, but I guess you could
start by looking at the state files in the queue directory. Match up
the time/dates with the diff-less alerts.

On Mon, Feb 13, 2012 at 9:05 AM, Kat  wrote:
> Hi all..
>
> Here is an odd one. I have a folder with a few dozen subfolders. I
> want to set up "report_changes" on all the subfolders with a specific
> file in it - for example:
>
> /opt/conf/*/*act_config
>
> And it seems to work fine - but here is the odd part. The *sh_config
> is a txt file in every folder, and this is verified. Sometimes the
> report changes actually works and other times it only shows the
> checksums changing, which I know if the checksum changes the contents
> had to change.
>
> So the question is simple -- any idea what might cause the
> report_changes to work most of the time, but sometimes it only reports
> checksum? How would you debug this?
>
> Basically I have a system with 50-60 users and they each have one of
> the config files and they change them from time to time. So I want to
> know which user changed it and what the changed (so when they say "I
> didn't change anything" I can tell them and show them.  But the
> baffling part is this works 90% of the time, but every now and then,
> as mentioned, it does not show the actual changes.
>
> signed,
> confused...