OSSEC 101: Tuning Syscheck: — OSSEC v2.7.0 documentationAlert on new files:¶ By default syscheck does not alert on new files. This is done in an attemp to stop a flood of alerts on installation. Changing this behavior is very easy. First, add the following to the <syscheck> section of the OSSEC server’s ossec.conf: <syscheck> <!-- Frequency that syscheck is executed - default to every 22 hours --> <frequency>7200</frequency> <alert_new_files>yes</alert
