Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

report_changes should indicate if diff was truncated in notification #455

Open
ChristianBeer opened this issue Nov 26, 2014 · 0 comments
Open

Comments

@ChristianBeer
Copy link
Contributor

A normal rule 550 "Integrity checksum changes." notification with report_changes enabled looks like this at the moment:

Received From: server->syscheck
Rule: 550 fired (level 7) -> "Integrity checksum changed."
Portion of the log(s):

Integrity checksum changed for: '/etc/postfix/main.cf'
Size changed from '28911' to '29248'
What changed:
709a710
> # changed config
715,722c716,726
<     permit_mynetworks, 
<     reject_invalid_hostname,
<     warn_if_reject reject_non_fqdn_sender,
<     reject_unauth_destination, 
<     check_policy_service unix:postgrey/socket, 
<     reject_rbl_client zen.spamhaus.org,
<     reject_unknown_client,
<     reject_unknown_hostname

---
>                  permit_mynetworks, 
>   warn_if_reject reject_unknown_sender_domain,
>   warn_if_reject reject_unknown_recipient_domain,
>                  reject_invalid_hostname,
>   warn_if_reject reject_non_fqdn_sender,
Old md5sum was: '30092979a95d349e6638807a9a69e9dc'
New md5sum is : 'faad6c26c0be601cfc798d3b3e499ad2'
Old sha1sum was: '84017046c43125c6f8f39cfee2ae7ce778f9e0d2'
New sha1sum is : 'bafd479ef6b7ee998f3b141dbbcec3c5431a9ffd'

What the notice doesn't tell us is if the diff was truncated. In this case it was, because I know that I added some more lines after those shown. I don't need the whole diff but an indication that there are more changes in this file would be great. A simple line between the diff and the checksums that says:
... diff was truncated ... (or similar)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants