On Mon, Aug 27, 2012 at 6:00 PM, dan (ddp) <ddp...@gmail.com> wrote: > On Mon, Aug 27, 2012 at 1:57 PM, C. L. Martinez <carlopm...@gmail.com> wrote: >> On Mon, Aug 27, 2012 at 5:55 PM, dan (ddp) <ddp...@gmail.com> wrote: >>> On Mon, Aug 27, 2012 at 1:45 PM, C. L. Martinez <carlopm...@gmail.com> >>> wrote: >>>> Hi all, >>>> >>>> Active response needs to be configured in server an agent to work?? I >>>> am trying to activate for agents only, but doesn't seems to work ... >>>> Do I need to configure in ossec.conf's server config file, in >>>> agent.conf file or in both sides?? >>>> >>>> Thanks. >>> >>> Active response needs to be enabled on both the server and the agents. >>> You do not need to configure an active response to run on the server, >>> so it's almost like having it disabled on the server. >> >> Then, configuring only a command option on server side works?? > > All AR configuration (other than enabling/disabling AR on an agent) is > done on the server side.
Ok, thanks Dan
