OSSEC rootcheck issues on docker machines

[spencescu]

Hello,

We have the following OSSEC alerts on our servers running Docker:

Rule: 510 (level 7) -> 'Host-based anomaly detection event (rootcheck).'
Files hidden inside directory '/var/lib/docker/overlay2/7e2e883984c0f16a8a7c4bd5795fef5111c346fbe755f35a36e9a03149849607/merged/root/.ivy2/cache/com.google'. Link count does not match number of files (3,1).

Is this inherent to how Docker manages these files, and was this reported by other people too?

Thanks,
Sherman

[mlissner]

This is very much filed in the wrong place. It's a dup of: ossec/ossec-hids#1855. Suggest closing.

[github-actions]

We are clearing up our old issues and your ticket has been open for 6 months with no activity. Remove stale label or comment or this will be closed in 15 days.