Receiving diffs for files enumerated in <nodiff>...</nodiff>

[oss...@mail.ru]

Hi,

I have configured several paths in <nodiff>...</nodiff> in the
/var/ossec/etc/ossec-server.conf. For example I have

<nodiff>/etc/letsencrypt/live/example.com/privkey.pem</nodiff>

Nevertheless I receive messages with changes like this

Rule: 552 fired (level 7) -> "Integrity checksum changed again (3rd time)."
Portion of the log(s):

Integrity checksum changed for:
'/etc/letsencrypt/live/example.com/privkey.pem'
What changed:
[...]

I tried putting all such paths delimited with commas on one line between
one pair of <nodiff>...</nodiff> and every path on the line of its own
between its own pair <nodiff>...</nodiff>. The result is the same.

What am I doing wrong?

Best regards,
Michael Dukelsky

[José Manuel López del Río]

Hi,

Have you introduced this tag inside the syscheck stanza of the configuration applied to the agents? It should look like this:

<syscheck>

...

<nodiff>/etc/letsencrypt/live/example.com/privkey.pem</nodiff>  

</syscheck>

Note that this configuration should be set on every endpoint where you would not like to send this information. It is possible that you are still receiving this information from agents that were not configured this way.

Lastly, make sure that you have restarted the service to apply the modifications made in the configuration file.

Let me know if you need anything else.