Hi! Well, I just deleted the old agent.conf on the agent at it receives a new one. Now it works, but I don't know why. My productive agent.conf looks a bit different to this simple example here (of course ;-) It's the same agent.conf for all agents. Some work some do not.
2010/5/20 dan (ddp) <[email protected]> > Did the agent receive the new agent.conf? > Did you restart the agent processes afterwards? > > On Thu, May 20, 2010 at 4:35 AM, Mike Sievers > <[email protected]> wrote: > > Hi List, > > > > it looks like, that ossec is igoreing my agent.conf. > > > > But why? > > > > My test is very simple: > > > > <agent_config> > > <localfile> > > <location>/var/log/my.log</location> > > <log_format>syslog</log_format> > > </localfile> > > </agent_config> > > > > I have no file my.log , so I expected to get an error like: > > ossec-logcollector ERROR: Unable to open file '/var/log/my.log'. > > > > But it does't. > > DIRECTORY="/var/ossec" > > VERSION="v2.3" > > TYPE="agent" > > > > Best regards, > > Mike > > >
