While creating the agent.conf in /var/ossec/etc/shared for centralized agent control. I made a mistake and a called the file ossec.conf. After restarting ossec on the server and seeing that the agents were not picking up the configuration, I noticed my mistake and changed the name of the file from ossec.conf to agent.conf. The agents are now being managed from the server and everything seems well, except that I am seeing the following warning messages in the logs:
2010/06/21 12:13:16 ossec-config(1756): ERROR: Duplicated directory given: '/etc'. 2010/06/21 12:13:16 ossec-config(1756): ERROR: Duplicated directory given: '/bin' and 2010/06/21 12:16:14 ossec-logcollector: WARN: Duplicated log file given: '/var/log/messages'. 2010/06/21 12:16:14 ossec-logcollector: WARN: Duplicated log file given: '/var/log/secure'. 2010/06/21 12:16:14 ossec-logcollector: WARN: Duplicated log file given: '/var/log/maillog'. 2010/06/21 12:16:14 ossec-logcollector: WARN: Duplicated log file given: '/var/log/httpd/error_log'. 2010/06/21 12:16:14 ossec-logcollector: WARN: Duplicated log file given: '/var/log/httpd/access_log' I read a post about clearing the rids directory after duplicate entries from a client restore, but wasn't sure if this applied here. Any help would be greatly appreciated. Thanks, John
