Re: [ossec-list] Re: report_changes=yes not reporting diffs in alerts

2012-11-28 Thread Mathew Crane
Bah, it must not have pushed out the agent.conf on the server. Thanks. On Wed, Nov 28, 2012 at 9:35 AM, dan (ddp) wrote: > On Wed, Nov 28, 2012 at 10:01 AM, mcrane0 wrote: > > ossec.conf on server, relevant portion: > > > > > check_all="yes">/etc,/var/ossec/etc > > /usr/bin,/usr/sbin

Re: [ossec-list] Re: report_changes=yes not reporting diffs in alerts

2012-12-04 Thread Mathew Crane
To add to the confusion, this just started working for me after a restart of the agent and server (this is not the first time a restart was attempted). I'll keep digging to see if the issue presents itself again. On Tue, Dec 4, 2012 at 1:05 PM, Jb Cheng wrote: > I tried the followingconfi