Hi Stephen, Sorry about it. I made a fix for it and released it on the following snapshot:
http://www.ossec.net/files/snapshots/ossec-hids-070829.tar.gz Just install it on your agent and disable active response as it should be: <active-response> <disabled>yes</disabled> </active-response> Hope it helps. -- Daniel B. Cid dcid ( at ) ossec.net On 8/22/07, Stephen Williamson <[EMAIL PROTECTED]> wrote: > > Will I did as you suggested > > <active_response> > <disabled>yes</disabled> > </active_response> > > > but it stops in error on the change. See below. > > Steve > > OSSEC HIDS v1.3 Stopped > Starting OSSEC HIDS v1.3 (by Daniel B. Cid)... > 2007/08/22 09:06:10 ossec-agentd(1230): Invalid element in the > configuration: 'active_response'. > 2007/08/22 09:06:10 ossec-agentd(1202): Configuration error at > '/var/ossec/etc/ossec.conf'. Exiting. > 2007/08/22 09:06:10 ossec-agentd(1215): No client configured. Exiting. > ossec-agentd: Configuration error. Exiting > > --------------------------------- > Hi Stephen, > > It is actually a bug in ossec. You need to set it to: (note the > underline instead of a dash) > > <active_response> > <disabled>yes</disabled> > </active_response> > > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > -- > > >
