Hello, Thanks for the reply. I did not know about the ar.conf file. I checked and it pushed it down over time.
Xen On Aug 20, 11:09 am, Daniel Cid <[email protected]> wrote: > Hi, > > You don't need the configuration on the client side. The manager takes > a while to push the > new config (ar.conf) to the agent, so if you wait for a bit it should > arrive in there. > > Can you look at the ar.conf (inside the shared directory on the agent) > to see if it has a new > entry for your response? > > Thanks, > > -- > Daniel B. Cid > dcid ( at ) ossec.net > > On Tue, Aug 18, 2009 at 6:05 PM, xen<[email protected]> wrote: > > > I am trying to run a custom command on my Windows client. The cmd > > file is in the active-response/bin folder with appropriate > > permissions. > > > I am getting this error message in my Windows OSSEC log > > > 2009/08/18 13:16:52 ossec-agent: WARN: Unknown message received. No > > action defined. > > > 2009/08/18 13:16:52 ossec-agent: WARN: Unknown message received. No > > action defined. > > > In the client I have > > > <command> > > <name>atest</name> > > <executable>atest.cmd</executable> > > <expect>srcip</expect> > > <timeout_allowed>no</timeout_allowed> > > </command> > > > On the server I have > > > <command> > > <name>atest</name> > > <executable>atest.cmd</executable> > > <expect>srcip</expect> > > <timeout_allowed>no</timeout_allowed> > > </command>
