Re: AIDE "atime in future" false alarms
Virolainen Pablo <pablo@cs.tut.fi> writes:
> On Sun, 29 Oct 2000, Cristian Ionescu-Idbohrn wrote:
>
> > Is there a way to make it _not_ bother about atime stamps (and only
> > atime time stamps) on that particular directory tree?
>
> /some/directory/ do_all_kind_of_checks-a
>
> But remeber that this must be the first rule that hits to this
> "/some/directory"
>
> (hope I got this right)
> need some dr.pepper....
Actually no.
Even with that line aide checks the file for broken timestamps.
What aide does not do is compare the atime with the previous atime.
Broken timestamp checking is not an option at the moment.
It is mandatory for all files that are added to the database.
Rami
--
AIDE - Advanced Intrusion Detection Environment
Check http://www.cs.tut.fi/~rammer/aide.html
Reply to: