[ossec-list] Re: Integrity Checks and Diffs?

[Forrest Aldrich <forrie@xxxxxxxxxx>]

I would also see it as administratively expensive to dig up copies of 
these files and diff them manually, in the case where you really needed 
to see what changed.

_F



> Erick Kinnee wrote:
> > That is administratively expensive.
> >
> > In my environment there is no "change control" per se for some 
> > people. Many customers that have their own boxes; in some cases and 
> > we have no control over what they do, although I do want to know if 
> > those boxes are exploited in some fashion. Some of those boxes aren't 
> > even backed up as the customer doesn't want it or elected not to pay 
> > for it. Most of our customers your idea would work for, but getting 
> > the tape loaded and pulling the data to a stagin area for comparison 
> > as I said is administratively expensive.