Ignore /dev/.blkid.tab system audit noise

[Darren Patterson]

On 2.7.1 when running "./syscheck_control -i #" for my servers, recently I started seeing lots of messages:

System Audit: File '/dev/.blkid.tab' present on /dev. Possible hidden file.

Is there a way to suppress/ignore this?

Thanks,
-darren

[dan (ddp)]

Is that from an alert?

> Thanks,
> -darren
>
> --
>
> ---
> You received this message because you are subscribed to the Google Groups
> "ossec-list" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to ossec-list+...@googlegroups.com.
> For more options, visit https://groups.google.com/d/optout.

[Darren Patterson]

I'm not looking at the alerts - I'm only looking at the "syscheck -i" output for these systems.  For other noise in this output, I adjusted the shared rules (/var/ossec/etc/shared/*).  I don't see anything in /var/ossec/etc/shared/* that corresponds with this system audit message.

[dan (ddp)]

I took a moment to look at the code, and without spending too much
time tracking it down, it looks kinda built in. If this message is
causing you a lot of issues, you could probably adjust the code a bit
to make it non-critical or something.