[osiris] Osiris monitoring of log files

[Joel Duckworth]

Hi Everyone, I've some questions about the configuration of Osiris.

Part of the PCI DSS requirements is as follows:

        10.5.5 Use file integrity monitoring and change detection
software on logs to ensure that existing log data cannot be changed
without generating alerts (although new data being added should not
cause an alert).

Given this requirement is there a way to configure Osiris to perform
file scanning that will not report a file being appended to, but will
report on changes to existing data?

If this is possible then Osiris should satisfy the file integrity
portion of the PCI DSS requirements... I've investigated Tripwire
Enterprise and found that it does perform this type of scan, by the
following steps:

- The baseline scan is created which has the file size and checksum of
the log file.
- The new scan will read the log file up to the size of the baseline
scan size and verify the checksum against the baseline to that point also.
- If the data is the same then the file is not flagged and a new file
size and checksum is created for the entire file (this will have the
effect that appending new data is allowed)
- If the checksum fails the file is flagged.

It may also be useful to build into the checking some automatic handling
of log files that are archived into *.1 *.2 *.3 etc or even *.1.gz
*.2.gz etc

Any Ideas?

Regards,
Joel Duckworth