[Aide] AIDE Syslog !!!

[Richard van den Berg]

Hello Roudy,

First off, we have a mailing list for these sorts of questions, please
subscribe to it: https://mailman.cs.tut.fi/mailman/listinfo/aide

Roudy Veve wrote:
> LOG=>
> 
> /var/adm/sulog   LOG
> 
> I increase and enven decrease the sulog file
> to size 0, and aide did not see anything happening
> to this file.

What do you mean "happening to this file". The file size is not reported
when running "aide --check" ?

> Please tell me what this rule suppose to do or not,
> I am totally confused with the "S" growing size rule.

It reports the file size as changed only when the new file size is
smaller than the file size in the aide.db.

> running: aide-0.10 on Solaris-9 Sparc.

You should really upgrade to aide 0.12. Many bugs have been fixed since
version 0.10.

Sincerely,

Richard van den Berg