It doesn't overwrite it as ddp said. There is an agent.conf file in each ossec agents install dir under /etc/shared/. This file will be replaced everytime the agent.conf on the server is changed with the updated one. However the ossec.conf located in /etc will remain unchanged. Every time you start ossec on the agent with /etc/init.d/ossec start/restart or ossec-control start/restart it will first read the ossec.conf, then the agent.conf and then merge the config data in both files to an overall configuration.
However I don't know what would happen if you have contradicting config options in the two files (e.g. ignore one dir for syscheck in the agent.conf and monitor it in the ossec.conf). Maybe the agent won't start but exit with an error, maybe the agent.conf has a higher priority, maybe ossec.conf does. On Thu, Mar 11, 2010 at 2:53 PM, dan (ddp) <[email protected]> wrote: > It should merge with the agent configuration. > > On Wed, Mar 10, 2010 at 8:02 PM, Andy Tripp <[email protected]> wrote: > > Am I correct that when I have defined part of a centralized agent > > configuration it will merge or overwrite the local agent config and not > > replace it? > > > > > > > > Thanks > > > > ________________________________ > > CONFIDENTIALITY NOTICE: This correspondence, and all attachments > transmitted > > with it, may contain legally privileged and confidential information > > intended solely for the use of the intended recipient. If the reader of > this > > message is not the intended recipient or the employee or agent > responsible > > to deliver it to the intended recipient, you are hereby notified that any > > reading, dissemination, distribution, copying or other use of this > > communication is strictly prohibited. If you have received this message > in > > error, please notify the sender immediately by telephone at 580.213.1730, > or > > by electronic mail [email protected], and delete this message and all > > copies and backups thereof. Failure to comply with this confidentiality > > notice may result in criminal or civil penalties and/or prosecution. > > >
