[ossec-list] alert_new

[ossec-list] alert_new_files problem

To: ossec-list@xxxxxxxxx

Subject: [ossec-list] alert_new_files problem

From: PKTan <jpktan@xxxxxxxxxxxx>

Date: Tue, 9 Oct 2007 08:55:26 -0700 (PDT)

Authentication-results: mx.google.com; spf=pass (google.com: domain of jpktan@xxxxxxxxxxxx does not designate 64.233.182.184 as permitted sender) smtp.mail=ossec-list+caf_=ossec-list=googlegroups.com@xxxxxxxxx; domainkeys=pass (test mode) header.From=jpktan@xxxxxxxxxxxx

Authentication-results: mx.google.com; spf=neutral (google.com: 68.142.200.143 is neither permitted nor denied by best guess record for domain of jpktan@xxxxxxxxxxxx) smtp.mail=jpktan@xxxxxxxxxxxx; domainkeys=pass (test mode) header.From=jpktan@xxxxxxxxxxxx

Hi,

I am evaluating the OSSEC software, tried configure the alert_new_files option in the syscheck configuration , but it didn't work.

I created a "c:\test" folder with 2 files. Added the following to the window oseec agent ossec.conf

      syscheck>
<frequency>60</frequency>
<directories check_all="yes">C:\test</directories>
<alert_new_files>yes</alert_new_files>
<auto_ignore>no</auto_ignore>

    ...
    ...
    ...
    ...
</syscheck>

after restarting the agent , I added files into the c"\test directory, but OSSEC-SERVER didn't receive any new file alert.

Anyone can advise what go wrong ?

Do I need to make any chance to the server ossec.conf file ?

your prompt reply is greatly appreciated.

Thank you in advance.

Regards

John

Real people. Real questions. Real answers. Share what you know

www.ossec.net

http://www.ossec.net/en/mailing_lists.html