No, it's because the files are changing. Find out what's changing motd.
Does your message of the day regularly change (update information on
outages or something)? If so, you can probably put an ignore in for
it.
On Wed, Sep 28, 2011 at 9:08 AM, AlgoBoy wrote:
> My bad, I think these integrity er
My bad, I think these integrity errors mainly happen because I'm not
restarting ossec i.e. ossec-control stop and start.
On Sep 28, 5:59 pm, AlgoBoy wrote:
> OSSEC HIDS Notification.
> 2011 Sep 22 09:15:57
>
> Received From: ip-10-251-134-240->syscheck
> Rule: 551 fired (level 7) -> "Integrity ch
OSSEC HIDS Notification.
2011 Sep 22 09:15:57
Received From: ip-10-251-134-240->syscheck
Rule: 551 fired (level 7) -> "Integrity checksum changed again (2nd
time)."
Portion of the log(s):
Integrity checksum changed for: '/etc/motd'
Old md5sum was: 'dcf4d83bef51a84bbe48b9b5a38b60fe'
New md5sum is
