Is Wazuh monitoring directories set as volumes ?

[mrik974]

Hi. I have a question.
I looked at the ossec.conf and there seem to be directories registered for monitoring.
But, in Docker, and in Kubernetes DaemonSet configuration, different directories are set as volumes to map the root directory of the node to the container. In the container, those directories are either under /rootfs or /host .
I'm not sure Wazuh makes a scan of these directories. Can someone tell me if I'm wrong ?

[pyToshka]

You can check https://github.com/pyToshka/docker-wazuh-agent/blob/main/ossec.jinja2#L235
As well daemon set in repo it’s just example. You need to configure based on your requirements