Hi, You don't need the configuration on the client side. The manager takes a while to push the new config (ar.conf) to the agent, so if you wait for a bit it should arrive in there.
Can you look at the ar.conf (inside the shared directory on the agent) to see if it has a new entry for your response? Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Tue, Aug 18, 2009 at 6:05 PM, xen<[email protected]> wrote: > > I am trying to run a custom command on my Windows client. The cmd > file is in the active-response/bin folder with appropriate > permissions. > > I am getting this error message in my Windows OSSEC log > > > 2009/08/18 13:16:52 ossec-agent: WARN: Unknown message received. No > action defined. > > 2009/08/18 13:16:52 ossec-agent: WARN: Unknown message received. No > action defined. > > In the client I have > > <command> > <name>atest</name> > <executable>atest.cmd</executable> > <expect>srcip</expect> > <timeout_allowed>no</timeout_allowed> > </command> > > On the server I have > > <command> > <name>atest</name> > <executable>atest.cmd</executable> > <expect>srcip</expect> > <timeout_allowed>no</timeout_allowed> > </command> > > >
