You can specify which files to include/exclude in your tripwire config file.
George
Quoting Scott H <
scottlhenderson@yahoo.com>:
> So now that I'm an at-home Linux user that has
> begun to use Linux at my company for servers
> (formerly all was MS), I'm faced with *NIX admin
> issues that are all new to me. Today's example
> is: I have a RH7.3 server with tripwire installed
> and a cron job that emails a tripwire report to
> me daily. Works great. RH7.3 has a log rotation
> system set up by default, and this works well
> too, rotating the logs once per week. But of
> course, tripwire notices each week and reports
> that the log files have been changed (I'm
> guessing it's the inode # that changes on these?)
> and puts it in the report. Now, I want to know
> if a cracker messes with my log files, of course,
> so I DO want tripwire to monitor these files.
> But I DON'T want tripwire to report on the
> routine, weekly log file rotation, causing me to
> have to go in and do an update on the tripwire
> db. How do I fix this?
>
> Thanx,
>
> Scott
>
>
> .
>
>
>
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
> http://mailplus.yahoo.com
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
(text/plain)