I have a ossec installed as master/agent setup. There are about 30 agents running with one master. I recently changed the ossec.conf to monitor changes in directories to real time
<directories realtime="yes" check_all="yes">/etc,/usr/bin,/usr/sbin</
directories>
<directories realtime="yes" check_all="yes">/bin,/sbin</
directories>
do i have to add this change ( realtime="yes" ) to each agents
ossec.conf or is just changing it on the master and restarting ossec
enough.
