Hi Peter, Yes, sorry for the bad advice. It will not work properly the way I said. I just did quick test in here and having two set of responses, one with the "server" as the location and the other as "all" , should do what you want.
Hope it helps. -- Daniel B. Cid dcid ( at ) ossec.net On Dec 1, 2007 1:06 PM, Peter M. Abraham <[EMAIL PROTECTED]> wrote: > > Greetings Daniel: > > The "all|server" in location ended up just putting the active-response > on the server, and missed all of the agents. > > If I used two sets of active responses (same sid's), one with location > all and one with location server, would that work or would the last > set overwrite the first set? > > Thank you. >
