[ossec-list] Re: timestamp for modified files

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Chad,

Ossec does not really care about the reported time change for the file
(using the
stats call), because this can be easily faked. We could add that for "curiosity"
reasons, but shouldn't be trusted if the change is malicious.

*I will add that for our todo list, since it can be used to track
valid file changes.

Thanks.

--
Daniel B. Cid
dcid ( at ) ossec.net

On 4/13/07, Chad Rober <chadrober@xxxxxxxxx> wrote:
> I've noticed the time a notification is sent regarding file with a different
> checksum can be greatly different from the actual time the file changed.
> I'll assume this is due to the frequency that OSSEC scans for file changes.
>
> What I was wondering is how would I configure the client to read the
> modified time value and append that information to the notification email?
> Is that possible with the current build?
>
> Thanks!