Using the latest snapshots it is possible to control the agents from the server. Follow the directions here: http://www.ossec.net/dcid/?p=173
If you're using 2.0, you'll have to configure the agents to monitor /opt. If you have an /opt on the server you'll have to configure it also. On Wed, Jun 24, 2009 at 8:30 AM, HouseofSwartz<[email protected]> wrote: > > I am at a loss as to figure out which ossec.conf file I am to use to > configure syscheck to monitor specific files. > For example: if on one (or more) agents there is a directory "/opt/ > appfiles" that I need to monitor, do I specify this in the servers's > config file, or the agents'? or both? > > Does the same hold true for Windows? > > I apologize for what is seemingly a simple question, but I can't find > the answer anywhere else. > > Thank you for any help, > > Patrick >
