[ubuntu-uk] need help with ossec

[Vitorio Okio]

I've tried to edit "ossec.conf" file in /var/ossec/etc but was not 
allowed to save changes.

Before editing the file I had stopped OSSEC executing "sudo 
/etc/init.d/ossec stop".  Then tried both "gksudo gedit 
/var/ossec/etc/ossec.conf"  and "sudo -s" and then as root tried to 
edit the file.

In both cases in Gedit I get Save option disabled with no way to save 
changes.  In Vim I was prompted for an attempt to save a read-only 
file and then bash reported an error.

It look obvious to me that OSSEC rightfully protects its files and 
this is the problem.  Thus I'm not looking for a work around (like 
removing read-only attrib, etc.) here but rather for the right way to 
do things.  But so far I've not found anything related to the case in 
OSSEC's documentation and wiki.

Anybody uses OSSEC here and can help?