Hi Peter, Not really, since the while lists are all global. You can, however, create local rules matching on the agent name and on the desired ip address to ignore them.
Example: <rule id="12345" level="0"> <if_level>5</if_level> <hostname>test1</hostname> <srcip>1.2.3.4</srcip> <description>Ignoring ip 1.2.3.4 for agent test1</description> </rule> *If you still want to see the alerts, just put a higher level, like 2 or 3. *You may want to update to http://www.ossec.net/files/snapshots/ossec-hids-071211.tar.gz since I just fixed a bug on the "if_level" usage Hope it helps. -- Daniel B. Cid dcid ( at ) ossec.net On Dec 9, 2007 9:23 AM, Peter M. Abraham <[EMAIL PROTECTED]> wrote: > > Greetings: > > I tried creating a global white list on the agent servers, but that is > not working. > > Is there a way to have specific white lists per agent whether on the > server (where it is agent specific) or the agent? > > Thank you. >
