[ossec-list] Re: What is the best way to preserve the excluded rules in ossec.conf

["Daniel Cid" <daniel.cid@xxxxxxxxx>]

Hi Peter,

I see now what you mean. Our upgrade process currently does not handle that
very well and we should fix it for the next version. If you don't mind
opening a bug
about it, I will make sure to look at it before the next release.

http://www.ossec.net/bugs/

Thanks,

--
Daniel B. Cid
dcid ( at ) ossec.net

On 8/12/07, Peter M. Abraham <peter.m.abraham@xxxxxxxxx> wrote:
>
> Greetings Daniel:
>
> I don't mean on an individual rule basis, but in ossec.conf there are
> includes for rules which are not applicable for our environment.
>
> Such as
>
> <include>symantec-av_rules.xml</include>
>
> Right now I comment such rules out; but when I upgraded from 1.2 to
> 1.3, the upgrade process put them all back.
>
> Is there a way I can avoid that happening to our ossec server?
>
> Thank you.
>
>
>
>