[Aide] How to exclude ctime checks

[Bliss, Aaron]

here is complete rule set of rules:
 
# These are the default rules.
#
#p:      permissions
#i:      inode:
#n:      number of links
#u:      user
#g:      group
#s:      size
#b:      block count
#m:      mtime
#a:      atime
#c:      ctime
#S:      check for growing size
#md5:    md5 checksum
#sha1:   sha1 checksum
#rmd160: rmd160 checksum
#tiger:  tiger checksum
#haval:  haval checksum
#gost:   gost checksum
#crc32:  crc32 checksum
#R:      p+i+n+u+g+s+m+md5
#L:      p+i+n+u+g
#E:      Empty group
#>:      Growing logfile p+u+g+i+n+S
 
# You can create custom rules like this.
 
NORMAL = R+b+sha1
 
DIR = p+i+n+u+g

I'm trying for example to have NORMAL definated as not checking for
ctime changes; last night's scan of /boot still reported ctime changes
 
/boot   NORMAL

________________________________

From: aide-bounces at cs.tut.fi [mailto:aide-bounces at cs.tut.fi] On Behalf
Of Bliss, Aaron
Sent: Saturday, April 08, 2006 9:20 AM
To: aide at cs.tut.fi
Subject: [Aide] How to exclude ctime checks



I'm trying to figure out how to tell aide not to run ctime checks; I've
defined NORMAL in aide.conf as NORMAL = R+b+sha1; 

This is how R is defined #R:      p+i+n+u+g+s+m+md5 (this is the string
that I removed c from) ; any ideas?  Thanks. 

Aaron 

www.preferredcare.org
"An Outstanding Member Experience," Preferred Care HMO Plans -- J. D.
Power and Associates

Confidentiality Notice:
The information contained in this electronic message is intended for the
exclusive use of the individual or entity named above and may contain
privileged or confidential information.  If the reader of this message
is not the intended recipient or the employee or agent responsible to
deliver it to the intended recipient, you are hereby notified that
dissemination, distribution or copying of this information is
prohibited.  If you have received this communication in error, please
notify the sender immediately by telephone and destroy the copies you
received.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://mailman.cs.tut.fi/pipermail/aide/attachments/20060408/2952fbd0/attachment.html