Securing Your Server With A Host-based Intrusion Detection System

Discussion in 'HOWTO-Related Questions' started by PortMan, Sep 20, 2006.

  1. PortMan

    PortMan New Member

    I installed OSSEC HIDS and I'm now getting an email every minute with the following error:

    Received From: helix->syscheck
    Rule: 13 fired (level 8) -> "Integrity checksum of file '/etc/sysconfig/hwconf' has changed again (2nd time)"
    Portion of the log(s):


    1. What is this telling me?

    2. How do I correct the error?


    Thanks.
     
    PortMan, Sep 20, 2006
    #1
  2. falko

    falko Super Moderator Howtoforge Staff

    It is telling you that the file /etc/sysconfig/hwconf has changed.

    It's no error. If you think this file shouldn't have changed, you can now take further investigations, and if you think this is ok you can just ignore the mail. :)
     
    falko, Sep 21, 2006
    #2
  3. PortMan

    PortMan New Member

    Thanks for the reply. What type of changes would make this file change? I haven't changed any hardware or software.
     
    PortMan, Sep 21, 2006
    #3
  4. falko

    falko Super Moderator Howtoforge Staff

    I wouldn't worry too much about it. In this case I think it's the normal system behaviour.
     
    falko, Sep 22, 2006
    #4

Share This Page