[ossec-list] Re: ossec 0.9

["Miner, Jonathan W \(CSC\) \(US SSA\)" <jonathan.w.miner@xxxxxxxxxxxxxx>]

> 4. On Solaris, it may worth to include /var/adm/message to the
>    default monitor list.

I've been using it for about a week on two Solaris 9 machines.  One file that should be excluded is /etc/logadm.conf; the contents get rewritten with a datestamp every day.

I'm also having problems on the server with ossec-analysisd getting a segfault and crashing.  Haven't spent much time looking into this; ideas welcome, but I'll break out gdb and start debugging either later today or next.

> BTW, OSSEC is great. Easy to install and useful.

Definitely easy to install.  Any way for me to pre-compile binaries so that I can deploy OSSEC on machines that don't have compilers?  Can I simply copy the /var/ossec directory from one machine to another, then update the client keys?

THANKS!