[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ossec-list] What is the best way to preserve the excluded rules in ossec.conf



Greetings:

This morning I upgraded our ossec server (we use the client/agent
server approach) from 1.2 to 1.3.

Since we are still in the testing phase of ossec, and I was not sure
what rules were updated, I did answer "yes" to upgrade, but also "yes"
to install new rules.

I found that while most of /var/ossec/etc/ossec.conf was preserved,
the rules I had previously commented out where now uncommented.

Is there a "best practice" way of excluding rules from being processed
that can be preserved across updates?  If so, how?

Thank you.



OSSEC home | Main Index | Thread Index


OSSEC project: www.ossec.net.
Mailling list information: http://www.ossec.net/en/mailing_lists.html.