[Aide] Ignore changed filenames

[Sonixxfx]

Thanks Dave.

It is not as easy as you would expect. After some experimenting I
think something like this would be a proper configuration:

/root/fooa$ md5
/root/foob$ md5+I

I could not get this working before because /root/foob was reported as
beeing changed. This makes sense if /root/foob is in the database.
This setup allows /root/fooa to be changed to filename /root/foob, but
it will report /root/foob as beeing removed if it's in the database.
So for this to work /root/foob must not exist when the database is
beeing created.

If /root/foob exits one could rename the file to another filename and
ignore that name change. That is how you can apply it to log rotation
if I understand it correctly.

Ben



2007/12/26, Dave <tdbtdb+aide at gmail.com>:
> As bizarre as this whole idea sounds to me, when I did 'man aide.conf'
> I got this output:
>
>
>
> DEFAULT GROUPS
>        p:   permissions
> [snip]
>
>        S:   check for growing size
>
>        I:   ignore changed filename
>
> So, try adding 'I' to the relevant line of aide.conf and restart aide?
> And give my imagination a nudge, why would anyone ever want to do
> something like this?
> Dave
>
>
>
> On Dec 26, 2007 2:26 AM, Sonixxfx <sonixxfx at gmail.com> wrote:
> > Hi,
> >
> > I don't understand how I should configure Aide to ignore changed filenames.
> >
> > Let's say I have this file '/root/fooa' and I change it to
> > '/root/foob' by doing 'mv /root/fooa /root/foob'. If I want to ignore
> > the namechange with 'I', what do have have to use in aide.conf then?
> >
> > Thanks for the help and a merry christmas :)
> >
> > Regards,
> >
> > Ben
> > _______________________________________________
> > Aide mailing list
> > Aide at cs.tut.fi
> > https://mailman.cs.tut.fi/mailman/listinfo/aide
> >
> _______________________________________________
> Aide mailing list
> Aide at cs.tut.fi
> https://mailman.cs.tut.fi/mailman/listinfo/aide
>