On Aug 21, 2017 4:39 PM, "Leroy Tennison" <leroy.tenni...@gmail.com> wrote:
I have added to /var/ossec/etc/shared/agent.conf a profile for a class of machine and updated the agent's ossec.conf with the config-profile in the <client> block. Do I need to remove the <syscheck>, <rootcheck> and all <localfile> entries on the client or will the manager simply override them? Is the result "either (the manager configuration)/or (the agent configuration)" or cumulative (both components apply? Cumulative. All options are applied. It is important syscheck entries are not doubled up. Changing the agent.conf to over-riding ossec.conf options is something I am interesred in, but javen't had time for. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout. -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
