Thank you both, I appreciate it. I added the config to the global file instead of the local file.
So, I think realtime is behaving now, but not the rest. It's my understanding the scan frequency for the agent is set on the agent, not the global level. I've set the agent to about an hour, but it's not noting changes for the non realtime. I'm ok with setting it to less frequent and will try 4 hours next, and then a longer period after that. Unless it's all set on the global level (master server is 20hr), which didn't seem to be the case? Thanks, Matthew -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
