'syscheck_control -u agent_id' delete the syscheck history database file
for this agent on OSSEC server.
It's a way to reduce unwanted alerts, say, after the agent machine was
patched.
It does not delete anything on the agent machine.
On Tuesday, March 5, 2013 3:50:10 PM UTC-8, dan (ddpbsd)
On Mon, Mar 4, 2013 at 12:39 PM, Kat uncommon...@gmail.com wrote:
Just wondering if I am missing something. I have an agent that has used too
much space for syscheck changes. I want to re-init with new rules. If I run
syscheck_control with -u it says it will INIT the database, but the old
Just wondering if I am missing something. I have an agent that has used too
much space for syscheck changes. I want to re-init with new rules. If I run
syscheck_control with -u it says it will INIT the database, but the old
stuff is still there. So I have to get on every system to clear the old
