[ossec-list] Re: Integrity Checks and Diffs?

[David Vasil <dmvasil@xxxxxxxx>]

Forrest Aldrich wrote:
> 
> Maybe for text-only files, provide an option to include a contextual
> diff output, which shows the changes of the monitored file, with that of
> the known version --- this would require keeping that old version
> archived somewhere, though.  Hmm...     may be useful in some
> situations, knowing not only that the file was changed, but WHAT was
> changed.

That could come back and bite you in some situations where the file that
was changed contained sensitive information (which upon alert would be
sent to you through clear-text email).

-- 
-dave