On Mon, Jun 7, 2010 at 5:45 PM, dp <[email protected]> wrote: > I'm looking to make my client configs granular and have started > experimenting with agent.conf. > > I need to know a couple things: > > 1. What's the method of pattern-matching used? I saw "agent1|agent2" > in the example. I found a reply on another thread from Mr. Cid which > seemed to indicate a "standard" regex used, i.e., ^ to match > beginning, $ to match end. I'm wondering if > > <agent_config name="somebox11[234].*"> > > would match somebox112, somebox113, and somebox114? Should I match > for the whole string with ^ $ around it? > > 2. How can I verify concretely the full config used by a particular > client once I get these rolled out? On the server I can md5sum the > agent.conf and then agent_control -i ID for a match...but in testing > this seems to always match, regardless of the client ID. Shouldn't > the etc/ossec.conf or at least the etc/shared/agent.conf on the client > contain precisely what's being used for that client? > >
2. Every client gets the entire agent.conf, and only uses the parts that apply to that system.
