Will I did as you suggested
<active_response>
<disabled>yes</disabled>
</active_response>
but it stops in error on the change. See below.
Steve
OSSEC HIDS v1.3 Stopped
Starting OSSEC HIDS v1.3 (by Daniel B. Cid)...
2007/08/22 09:06:10 ossec-agentd(1230): Invalid element in the
configuration: 'active_response'.
2007/08/22 09:06:10 ossec-agentd(1202): Configuration error at
'/var/ossec/etc/ossec.conf'. Exiting.
2007/08/22 09:06:10 ossec-agentd(1215): No client configured. Exiting.
ossec-agentd: Configuration error. Exiting
---------------------------------
Hi Stephen,
It is actually a bug in ossec. You need to set it to: (note the
underline instead of a dash)
<active_response>
<disabled>yes</disabled>
</active_response>
Thanks,
--
Daniel B. Cid
dcid ( at ) ossec.net
--
