Remove old snapshot files for FIM

[Cerv1]

Now syscheck deletes the folders from queue/diff/local that are not currently being monitorized or have the report_changes attribute disabled.

To enable this feature, the option <remove_old_diff> must be yes in the ossec.conf.

Example of use.

<remove_old_diff>yes</remove_old_diff>
<directories check_all="yes" report_changes="yes" realtime="yes">/dir</directories>

The above configuration generates the following structure:

├── diff
│   ├── local
│       └── dir
│           ├── first
│           │   └── level 2
│           │       └── file
│           │           └── last-entry
│           └── second
│               └── third
│                   └── fourth
│                       └── low_file
│                           └── last-entry

If we changed the previous configuration to:

<remove_old_diff>yes</remove_old_diff>
<directories check_all="yes" report_changes="no" realtime="yes">/dir</directories>

The files that were saved and now are no longer being monitorized, will be deleted. Therefore, our local file structure will be the next one:

├── diff
│   ├── local