I'm looking to make my client configs granular and have started experimenting with agent.conf.
I need to know a couple things: 1. What's the method of pattern-matching used? I saw "agent1|agent2" in the example. I found a reply on another thread from Mr. Cid which seemed to indicate a "standard" regex used, i.e., ^ to match beginning, $ to match end. I'm wondering if <agent_config name="somebox11[234].*"> would match somebox112, somebox113, and somebox114? Should I match for the whole string with ^ $ around it? 2. How can I verify concretely the full config used by a particular client once I get these rolled out? On the server I can md5sum the agent.conf and then agent_control -i ID for a match...but in testing this seems to always match, regardless of the client ID. Shouldn't the etc/ossec.conf or at least the etc/shared/agent.conf on the client contain precisely what's being used for that client?
