{"action":"created","issue":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/845","repository_url":"https://api.github.com/repos/ossec/ossec-hids","labels_url":"https://api.github.com/repos/ossec/ossec-hids/issues/845/labels{/name}","comments_url":"https://api.github.com/repos/ossec/ossec-hids/issues/845/comments","events_url":"https://api.github.com/repos/ossec/ossec-hids/issues/845/events","html_url":"https://github.com/ossec/ossec-hids/issues/845","id":155213722,"number":845,"title":"How to enable real-time monitoring?","user":{"login":"Canon88","id":19372121,"avatar_url":"https://avatars.githubusercontent.com/u/19372121?v=3","gravatar_id":"","url":"https://api.github.com/users/Canon88","html_url":"https://github.com/Canon88","followers_url":"https://api.github.com/users/Canon88/followers","following_url":"https://api.github.com/users/Canon88/following{/other_user}","gists_url":"https://api.github.com/users/Canon88/gists{/gist_id}","starred_url":"https://api.github.com/users/Canon88/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Canon88/subscriptions","organizations_url":"https://api.github.com/users/Canon88/orgs","repos_url":"https://api.github.com/users/Canon88/repos","events_url":"https://api.github.com/users/Canon88/events{/privacy}","received_events_url":"https://api.github.com/users/Canon88/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-17T09:24:54Z","updated_at":"2016-05-17T11:25:31Z","closed_at":null,"body":"test environment:\r\n**agent ossec.conf**\r\nossec.conf\r\n[**< directories realtime=\"yes\" report_changes=\"yes\" check_all=\"yes\">/mnt </ directories >**]\r\n**/mnt/test1.file (already existing)\r\n/mnt/test2.file (newly added)**\r\n\r\nRead the manual, linux and must install inotify inotify-tools-devel in order to achieve real-time monitoring.\r\n\r\nWhy sometimes real-time monitoring to work, sometimes real time monitoring does not work?\r\nE.g:\r\nCreate '/mnt/test2.file' (new addition), use the vi editor 'test2.file', join 'this is a test!'\r\nThen edit /mnt/test1.file (already existing), real-time monitoring does not work.\r\n\r\nIt is to wait until after test2.file added to syscheck db, the real-time monitoring work.\r\nI do not know, real-time monitoring is that right?"},"comment":{"url":"https://api.github.com/repos/ossec/ossec-hids/issues/comments/219690455","html_url":"https://github.com/ossec/ossec-hids/issues/845#issuecomment-219690455","issue_url":"https://api.github.com/repos/ossec/ossec-hids/issues/845","id":219690455,"user":{"login":"ddpbsd","id":4983989,"avatar_url":"https://avatars.githubusercontent.com/u/4983989?v=3","gravatar_id":"","url":"https://api.github.com/users/ddpbsd","html_url":"https://github.com/ddpbsd","followers_url":"https://api.github.com/users/ddpbsd/followers","following_url":"https://api.github.com/users/ddpbsd/following{/other_user}","gists_url":"https://api.github.com/users/ddpbsd/gists{/gist_id}","starred_url":"https://api.github.com/users/ddpbsd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ddpbsd/subscriptions","organizations_url":"https://api.github.com/users/ddpbsd/orgs","repos_url":"https://api.github.com/users/ddpbsd/repos","events_url":"https://api.github.com/users/ddpbsd/events{/privacy}","received_events_url":"https://api.github.com/users/ddpbsd/received_events","type":"User","site_admin":false},"created_at":"2016-05-17T11:25:31Z","updated_at":"2016-05-17T11:25:31Z","body":"The realtime monitoring does not alert on new file creation, and a file has to have a baseline (created during a full scan) before the changes can be alerted on."}}