OSSEC HIDS v3.1.0 发出邮件alert 和服务器里的alert.log不一致

ossec linux centos 7

joeson 2018-11-13 10:11:58 ‧ 1974 瀏覽

分享至

Hi，
我的ossec server 是使用OSSEC HIDS v3.1.0，但通过邮件发出的alert有些不同。
Email alert:

OSSEC HIDS Notification.
2018 Nov 12 16:01:49
Received From: (nagios-server185) xxxxxxx->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):
Integrity checksum changed for: '/home/hehe.txt'

alerts.log

** Alert 1542009709.59473: mail - ossec,syscheck,
2018 Nov 12 16:01:49 (nagios-server185) xxxxxxx->syscheck
Rule: 550 (level 7) -> 'Integrity checksum changed.'
Integrity checksum changed for: '/home/hehe.txt'
Permissions changed from 'rwxr--r--' to 'rwxr-xr-x'

少了被改动的信息:如chown 和chmod permission changed。但diff的内容改变邮件收到的是正常。