Hi!

 

I have tried to set up a content matching with the File system monitor. I can get it to work on one Linux box, but not on another.

 

I tried using root account on both machines. For the machine were it wont work:

 

* It seems it can find the file correctly, and it displays the changes in file size.

* If I enable "Do file/directory age check" and set it to 5 hours, it immediately reports the device as down, and that the file is older than 5hrs, although the file is less than 2 minutes old.

* It doesnt seem to even read the file. Even if I create a brand new file, and only put in the exact same text as I have in the Content matching string, it wont react. Have tried using both "Only appended content" and "Whole file", both with the same negative result.

 

The OS on the machine that is not working is Fedora Core 4, and it is Red Hat Enterprise Linux 6 on the machine were I can get it to work.

 

Any ideas?