I'm having the same problem now too.
I tried doing something as simple as:
<agent_config>
<syscheck>
<!-- Frequency that syscheck is executed - change to every 6
hours -->
<frequency>21600</frequency>
<alert_new_files>yes</alert_new_files>
</syscheck>
</agent_config>
As of now it appears that only the one unix box I have, took the
agent.conf
Operating system: Linux unixtestbox.xxxxxxxxxxxxx.com
2.6.18-128.2.1.e..
Client version: OSSEC HIDS v2.1 /
c70050e941c9e8ebf7a5409095811a41
I tried the snapshot on one of the hosts and it still continues to
show:
Operating system: Microsoft Windows XP Professional Service Pack 3
(Bu..
Client version: OSSEC HIDS v2.0-SNP-090730
Any other ideas?
On Jul 30, 3:57 pm, Daniel Cid <[email protected]> wrote:
> Hi Danny,
>
> Can you try installing the latest snapshot of the Windows agent?
>
> http://ossec.net/files/snapshots/ossec-win32-090730.exe
>
> I made some fixes to the way we handle the Windows sockets that will
> probably solve this issue.
> What was happening is that the merged files (with all the shared
> configurations) were never
> arriving properly on the Windows agents.
>
> Thanks,
>
> --
> Daniel B. Cid
> dcid ( at ) ossec.net
>
> On Thu, Jul 30, 2009 at 3:10 PM, Danny Fullerton<[email protected]> wrote:
>
> > Hello guys,
>
> > I've been trying to deploy a centralized config but ran into some problems.
>
> > I followed "http://www.ossec.net/main/manual/centralized-config/"; and
> > created the /var/ossec/etc/shared/agent.conf file but only one of my
> > servers is actually presenting the agent.conf hash that is used to
> > confirm it is using the centralized configuration:
>
> > Client version: OSSEC HIDS v2.1 / 8688892c3e847ef52c1eb393c6e3f437
>
> > Every other clients show this info:
>
> > Client version: OSSEC HIDS v2.1
>
> > Is there a way to push the agent config? "agent_control -R", "restarting
> > the agent and windows service", "restarting ossecd", "restarting the
> > server", "reinstalling the agent and "creating a new client entry" does
> > not work.
>
> > thanks,
>
> > --
> > Danny Fullerton, GCIH GHTQ
> > Mantor Organization
