Skip to content

Comments

Fixed bug at logcollector that inhibited alerts about file reduction#848

Merged
ddpbsd merged 2 commits intoossec:masterfrom
wazuh:fix-logcollector
May 18, 2016
Merged

Fixed bug at logcollector that inhibited alerts about file reduction#848
ddpbsd merged 2 commits intoossec:masterfrom
wazuh:fix-logcollector

Conversation

@vikman90
Copy link
Contributor

@vikman90 vikman90 commented May 18, 2016

When OSSEC detects that a file size has been reduced, it updates this size into a local variable, but else it doesn't update it, so Logcollector is able to detect once that the current size of the file is lower than when the file was opened.

This fix makes logcollector update the cached size at each verification, allowing it to be more accurate comparing sizes and to alert if the file was shrunk.

@ddpbsd
Copy link
Member

ddpbsd commented May 18, 2016

The windows agent build is seeing the following error, maybe just a missing include?

logcollector/logcollector.c: In function ‘LogCollectorStart’:
logcollector/logcollector.c:546:29: error: ‘lpFileInformation’ undeclared (first use in this function)

@vikman90
Copy link
Contributor Author

It was a variable scope problem. Fixed!

@ddpbsd ddpbsd merged commit 1a99932 into ossec:master May 18, 2016
@vikman90 vikman90 deleted the fix-logcollector branch May 27, 2016 22:44
@vikman90 vikman90 restored the fix-logcollector branch May 27, 2016 22:44
@vikman90 vikman90 deleted the fix-logcollector branch May 27, 2016 22:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants