Hello, Everytime I make a change to the OSSEC configuration or decoder or rules file, it is necessary to restart all of the daemons. In a production environment, this is problematic since you end up loosing events. As I read through the ossec-control script, I wondered which daemon reads the configuration, decoder and rules file and whether it is possible to restart only that daemon so that events can be continued to be received and queued up until the new configuration is read?
Cheers! Trevor
