[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[ossec-list] What is the best way to preserve the excluded rules in ossec.conf
Greetings:
This morning I upgraded our ossec server (we use the client/agent
server approach) from 1.2 to 1.3.
Since we are still in the testing phase of ossec, and I was not sure
what rules were updated, I did answer "yes" to upgrade, but also "yes"
to install new rules.
I found that while most of /var/ossec/etc/ossec.conf was preserved,
the rules I had previously commented out where now uncommented.
Is there a "best practice" way of excluding rules from being processed
that can be preserved across updates? If so, how?
Thank you.
OSSEC home |
Main Index |
Thread Index
OSSEC project: www.ossec.net.
Mailling list information: http://www.ossec.net/en/mailing_lists.html.