File Monitoring (MTIME & SIZE)

Hi All,

I am trying to monitor files which should NOT be modified.

If have the SIZE and MTIME parameter setup as follows:

HOST=testhost.test.com FILE /etc/passwd TYPE=file OWNER=0 GROUP=0 MODE=644 SIZE=123456 MTIME>86400 red

This basically means that if the file is modified within the last 24 hours, or if the SIZE is different than 123456 it should go red...

It never goes to any other status other than green.

I also have the /etc/passwd entry in the clients-local.cfg file as well\

Any Ideas?