unable to trac file integrity changes in my custom directory #2138
Description
Hey guys, I'm trying to monitor any file changes under directory /path/to/file/
any files modification done as root user or using sudo access I can see alerts on my master ossec node
but any file modifications done by normal user I cannot see any alerts triggered.
I have added below lines in my /var/ossec/etc/ossec.conf file
<directories report_changes="yes" realtime="yes" check_all="yes">/client/tybatch/citi/shell/*.sh</directories> <directories report_changes="yes" realtime="yes" check_all="yes">/client/tybatch/citi/shell/*.ksh</directories>
Could someone please help me if I'm missing anything more to update