[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ossec-list
Subject:    [ossec-list] Syscheck- auto-ignore
From:       Black CryptoKnight <black_cryptoknight () yahoo ! com>
Date:       2006-12-15 5:46:49
Message-ID: 287636.34378.qm () web53714 ! mail ! yahoo ! com
[Download RAW message or body]

Is there anywhere to configure the threshold for auto-ignore?
Ie. can you change the number of file changes before auto-ignore ignores ignores that \
file?

I think it would be a good idea to allow for a "whitelist" in syscheck that would \
allow you to specify which files you never want syscheck to ignore when the auto \
ignore feature is enabled. Reason being, there are times when you may have to make \
frequent changes to lets say, a config file, but you still want each change to be \
tracked, but you want the auto-ignore feature to be functional to minimize the alerts \
from the less important file changes (like changes in log files or print spool \
files).







 
---------------------------------
Everyone is raving about the all-new Yahoo! Mail beta.


[Attachment #3 (text/html)]

Is there anywhere to configure the threshold for auto-ignore?<br>Ie. can you change \
the number of file changes before auto-ignore ignores ignores that file?<br><br>I \
think it would be a good idea to allow for a "whitelist" in syscheck that would allow \
you to specify which files you never want syscheck to ignore when the auto ignore \
feature is enabled. Reason being, there are times when you may have to make frequent \
changes to lets say, a config file, but you still want each change to be tracked, but \
you want the auto-ignore feature to be functional to minimize the alerts from the \
less important file changes (like changes in log files or print spool \
files).<br><br><br><br><br><br><br><p>&#32;


<hr size=1>Everyone is raving about <a \
href="http://us.rd.yahoo.com/evt=42297/*http://advision.webevents.yahoo.com/mailbeta">the \
all-new Yahoo! Mail beta.</a>



[prev in list] [next in list] [prev in thread] [next in thread]