[ossec-list] alert_new_files

["Serge Dubrouski" <sergeyfd@xxxxxxxxx>]

Hello -

I might be mistaken but it looks like there is a bug in handling
"alert_new_files" config option. Per documentation that option has to
be used in <syscheck> part of ossec.conf file. But per source code in
syscheck-config.c that option isn't processed there:

        else if(strcmp(node[i]->element,xml_alert_new_files) == 0)
        {
            /* alert_new_files option is not read here. */
        }

though there is a code to read and process it in global_config.c:

        else if(strcmp(node[i]->element,xml_alert_new_files) == 0)
        {
            if(strcmp(node[i]->content, "yes") == 0)
            {
                Config->syscheck_alert_new = 1;
            }
            else if(strcmp(node[i]->content, "no") == 0)
            {
                Config->syscheck_alert_new = 0;
            }

Now when I set this option in <sycheck> it's ignored bu ossec and I
receive no alarms on new files. If I try to set this option in
<global> section then ossec complains about an error in configuration:

2007/05/24 20:29:48 ossec-maild(1230): Invalid element in the
configuration: 'alert_new_files'.
2007/05/24 20:29:48 ossec-maild(1202): Configuration error at
'/var/ossec/etc/ossec.conf'. Exiting.
2007/05/24 20:29:48 ossec-maild(1202): Configuration error at
'/var/ossec/etc/ossec.conf'. Exiting.
ossec-maild: Configuration error. Exiting

So where is the real problem?

Thanks.

Serge Dubrouski.