Hi Peter, The agent.conf file complements the local agent configuration. It does not overwrite, but adds to the configuration (like if you added a new option at the bottom of the local ossec.conf).
Right now there is no way to set custom variables like that. The agent doesn't know if the system is a web server or database server or anything else. We could check if IIS (or apache) are running and set a variable, but I believe that should be done by the administrator. You can set all your agents that are web servers, for example, putting an agent list: <agent_config name="agent1|agent2|agent3"> .. </agent_config> Hope that helps. -- Daniel B. Cid dcid ( at ) ossec.net On Wed, Jul 1, 2009 at 5:23 PM, Peter M. Abraham<[email protected]> wrote: > > Greetings: > > RE: http://www.ossec.net/main/manual/centralized-config/ > > > 1. Does the settings in /var/ossec/etc/shared/agent.conf complement > the settings on the agent server? > > Meaning, can you have both where both will be used? > > If the answer is yes, does /var/ossec/etc/shared/agent.conf overwrite > or otherwise rule over the /var/ossec/etc/ossec.conf file on the agent > server? > > > 2. Is there a way to have custom variables? > > i.e. not just on operating system (which appears to be built in), but > to have a variable that can be set on the agent side to indicate "web > server" vs. "email server" vs. "database server" etc.? > > If so, how? > > Thank you. >
