How often does syscheck run?¶
By default, Syscheck runs every 6 hours, but the interval between scans can be user-defined with the frequency option.
What is the CPU usage like on the agents?¶
Syscheck scans are designed to run slowly to avoid too much CPU or memory use.
Where are all the checksums stored?¶
All of the checksums are stored on the manager
Can I ignore files in a directory?¶
Can Wazuh report changes in the content of a text file?¶
Yes, this is possible when monitoring directories. Using the
report_changes option gives the exact content that has been changed in text files within the directory being monitored. Be selective about which folders you use
report_changes on, because this requires syscheck to copy every single file you want to monitor with
report_changes to a private location for comparison purposes.
See an example of this configuration by clicking on report changes
How does Wazuh verify the integrity of files?¶
The Wazuh manager stores and looks for modifications to all the checksums and file attributes received from the agents for the monitored files. It then compares the new checksums and attributes against the stored ones, generating an alert when changes are detected.
Does Wazuh monitor any directories by default?¶
Yes. By default Wazuh monitors
/sbin on Unix-like systems and
C:\Windows\System32 on Windows systems.
Can I force an immediate syscheck scan?¶
Yes, you can force an agent to perform a system integrity check with:
/var/ossec/bin/agent_control -r -a /var/ossec/bin/agent_control -r -u <agent_id>
See the Ossec control section for more information.
Does Syscheck start when Wazuh starts?¶
By default, syscheck scans when Wazuh starts, however, this behavior can be changed with the scan_on_start option