Greetings: RE: http://www.ossec.net/main/manual/centralized-config/
1. Does the settings in /var/ossec/etc/shared/agent.conf complement the settings on the agent server? Meaning, can you have both where both will be used? If the answer is yes, does /var/ossec/etc/shared/agent.conf overwrite or otherwise rule over the /var/ossec/etc/ossec.conf file on the agent server? 2. Is there a way to have custom variables? i.e. not just on operating system (which appears to be built in), but to have a variable that can be set on the agent side to indicate "web server" vs. "email server" vs. "database server" etc.? If so, how? Thank you.
