Good Morning Peter,
This is what I have currently on the windows agent and Linux server
respectively:
*Win*
<!-- Default files to be monitored - system32 only. -->
<directories check_all="yes">%WINDIR%/system32</directories>
<directories check_all="yes">e:\testdirectory\test</directories>
*Linux*
<!-- Directories to check (perform all possible verifications) -->
<directories check_all="yes">/etc,/usr/bin,/usr/sbin</directories>
<directories check_all="yes">/bin,/sbin</directories>
<directories check_all="yes"> e:\testdirectory\test </directories>
All services have been restarted as well.
Thanks,
Rico
-----Original Message-----
From: [email protected] [mailto:[EMAIL PROTECTED]
On Behalf Of Peter M. Abraham
Sent: Thursday, August 28, 2008 8:03 AM
To: ossec-list
Subject: [ossec-list] Re: OSSEC Windows Agent Help
Greetings Rico:
Most of the work is done on the server side in /var/ossec/etc/
ossec.conf
On the Windows side, in the ossec folder, also modify the ossec.conf
there for what log files you want to monitor and options. Be sure to
stop and start the agent on the Windows side for the changes to be
effective.
Thank you.
