Hi Gagan, It is certainly possible to do so. You just need to duplicate the keys, config and rules from one server to the other (using rsync or any other method). In the agent side, you can use the "server-hostname" tag instead of the server-ip to specify the server's host.
Also, on version 1.5, you can have multiple server-ip tags and the agent will switch to the other server if one becomes unavailable... Hope it helps. -- Daniel B. Cid dcid ( at ) ossec.net On Wed, Apr 16, 2008 at 8:55 AM, <[EMAIL PROTECTED]> wrote: > > Dear Mailing list > > There is some query regarding the Ossec Backup connectivity & logging. > > Is it possible to replicate the running ossec services to another > server. > > Can we add the host entry in agents in place of the IP address & > create a backup ossec server to get it prepared for any hardware/ > software failures. > So that in case of failures we only have to change the host record in > DNS and not the IP address on all agents. > Can we shift logs & agents connectivity (keys and queues) from one > ossec server to another.( So that ossec server should not result as > single point of failure) > > Regards > Gagan >
