[ossec-list] ossec 2.3 questions on Process monitoring

[Peter M. Abraham]

Greetings:

RE:  http://www.ossec.net/main/manual/manual-process-monitoring/

1.  Does the syntax for the command line processing need to go in each
agent ossec.conf file or can it be in the centralized server
ossec.conf file?

i.e. would I place

        <localfile>
            <log_format>command</log_format>

             <command>uptime</command>
         </localfile>

In the server or on the agent in the ossec.conf file?

2.  How often are the commands run?  Is there a way to control how
often the commands are run?

Thank you.