ossec realtime behavior changing a file

[pat brown]

What does OSSEC do if you have a file that you change and the put back again with a couple of seconds?

root@mpatalberta:~/joeblow# md5sum hellopat.txt 

4ede564a1a999242405ce4d5c13335ec  hellopat.txt <- original file

root@mpatalberta:~/joeblow# md5sum hellopat.txt 

4ede564a1a999242405ce4d5c13335ec  hellopat.txt

root@mpatalberta:~/joeblow# vi hellopat.txt 

root@mpatalberta:~/joeblow# md5sum hellopat.txt 

fc7fd69e2682cbe416382997304b093d  hellopat.txt. <- change file

root@mpatalberta:~/joeblow# vi hellopat.txt 

root@mpatalberta:~/joeblow# md5sum hellopat.txt 

4ede564a1a999242405ce4d5c13335ec  hellopat.txt.    <- put the file back to original

root@mpatalberta:~/joeblow# md5sum hellopat.txt 

4ede564a1a999242405ce4d5c13335ec  hellopat.txt

Pat,