[EMAIL PROTECTED] wrote: > > Hi, I know there's a new alert when Ossec start. > Maybe it should be a good idea to fire an alert if Ossec stop. > > That way we will be able to know if someone stop ossec.
I agree. But in the spirit of client/server, this could be accomplished if the scheduling of scans was taken care of by the server and not each of the clients. In this way, if the server tries to initiate a client scan, and the client is unreachable, it fires a warning message. This would give you better centralized management of your clients and also allow you to initiate scans at will. -- -dave
