[ossec-list] Re: What is the best way to preserve the excluded rules in ossec.conf

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Peter,

Yes, you should always set your rules on local_rules.xml, and never modify
the default ones.

http://www.ossec.net/wiki/index.php/Know_How:Ignore_Rules

I also explain a bit about it on my presentation at AusCERT earlier this year:

http://www.ossec.net/ossec-docs/auscert-2007-dcid.pdf

Hope it helps.

--
Daniel B. Cid
dcid ( at ) ossec.net

On 8/9/07, Peter M. Abraham <peter.m.abraham@xxxxxxxxx> wrote:
>
> Greetings:
>
> This morning I upgraded our ossec server (we use the client/agent
> server approach) from 1.2 to 1.3.
>
> Since we are still in the testing phase of ossec, and I was not sure
> what rules were updated, I did answer "yes" to upgrade, but also "yes"
> to install new rules.
>
> I found that while most of /var/ossec/etc/ossec.conf was preserved,
> the rules I had previously commented out where now uncommented.
>
> Is there a "best practice" way of excluding rules from being processed
> that can be preserved across updates?  If so, how?
>
> Thank you.
>
>