[Aide] How to properly use ANF?

[Marc Haber]

On Sat, Nov 12, 2005 at 02:53:15PM +0200, Virolainen Pablo wrote:
> On Sat, 12 Nov 2005, Marc Haber wrote:
> >Any idea why my ANF clause doesn't keep syslog.2.gz from being listed
> >as "added"?
> 
> Propably because ANF isn't working. We will mark file as moved in which 
> causes the file to be handled like "I".

Hmmm

> --- aide-ANF.broken/src/gen_list.c	Sat Nov 12 14:45:14 2005
> +++ aide-with-ANF/src/gen_list.c	Sat Nov 12 14:45:48 2005
> @@ -1122,7 +1122,7 @@
>        (file->attr & DB_NEWFILE) &&
>        (node->new_data!=NULL) &&
>        (node->old_data==NULL)) {
> -	 node->checked|=DB_NEW|NODE_MOVED_IN;
> +	 node->checked|=DB_NEW;
>    }
>  }

Having NODE_MOVED_IN or not doesn't seem to change anything.
syslog.2.gz is reported as added after log rotation.

Anything more that might be wrong?

Greetings
Marc

-- 
-----------------------------------------------------------------------------
Marc Haber         | "I don't trust Computers. They | Mailadresse im Header
Mannheim, Germany  |  lose things."    Winona Ryder | Fon: *49 621 72739834
Nordisch by Nature |  How to make an American Quilt | Fax: *49 621 72739835