[Ossec-list] syscheck db / security of ossec / logcolletor

[pedrodrimel at gmail.com (Pedro Drimel Neto)]

Hi all,

Thanks for the other answers...

I'm using ossec-7p1 on Linux with server and one agent, I have some doubts:

1 - Where is the "db" of syscheck about md5sum, size, etc of files and dirs 
? In AIDE for example I can save it in a floppy with only read mode.
2 - If an attacker is root, he cans kill the PID process so the attack will 
not be detected... right ?
3 - I edited /var/log/apache2/error.log incluind a string "Segmentation 
Fault" and the active-response was taken of a syslog_rules.xml
      Rule: 102 fired (level 7) -> "Possible problem (unknown) somewhere in 
the system"
     Is it rigth ?


Thanks a lot again,

Pedro.