Re: [Integrit-users] Why such a massive database?

[matt <ma...@ci...>]

On Tue, 28 Aug 2001, Franky Van Liedekerke wrote:
> You really don't want the mailspool to be checked

Sorry, I obviously didn't make the question clear enough.

With a no checksets, is the default behaviour to check everything
on the filesystem specified by root? That is what is happening to me.

That wasn't the behaviour I experienced with tripwire or aide.

As before:

> I got loads of stuff that had changed in the mail spool, the ttys
> etc. Am I doing something stupid or do I really have to say:
> 
> ! /
> 
> and then put the stuff that I want in?


Thanks,

Matt

-- 
#!/usr/bin/perl
$A='A';while(print+($A.=(grep{($A=~/(...).{78}$/)[0]eq$_}"  A A A  "
=~m{(...)}g)?"A":" ")=~/([ A])$/){if(!(++$l%80)){print"\n";sleep 1}}