[ossec-list] File integrity: How to check only owner/permission/deletion changes (No checksum)?

[Julia Vitoria Cardoso]

Hello. We are using OSSEC for file integrity monitoring as required by PCI
DSS, and i configured our monitoring as usual, all the not-constant
changing configuration files and stuff, ignore all log files and etc.

But we need to monitor if the logfiles are not compromissed. Checksum
checking would be crazy as it changes a lot, but basically now we want to
just check if the files are not deleted.

I was thinking about the options check_sum="yes" as the documentation says,
and i tried some theories like configuring to monitore the folder but only
with the options check permission, owner and group and hoped it would alert
if the file was deleted too, but all the ways i configured it always
alerted file changes.

I am thinking about creating a rule that ignores the alerts from specified
files, but still not happy with this options as it will stil alerts on
manager a lot.

Someone had this problem and can suggest something? Thanks