Thanks for this. Really useful. I cannot find centralized management in the book. It seems to have been written when 1.4 was the current version and this was introduced in 2.1 Some parts of the book are easier to understand than the site.
On Jul 20, 2:52 pm, Jason 'XenoPhage' Frisvold <[email protected]> wrote: > For clients, you can do this two ways. You can use the ossec.conf file on > the client, though this can get tedious rather quickly. For myself, I just > put the server IP in there and leave it be. The other option is to use > agent.conf on the server. I believe it's /var/ossec/etc/agent.conf. This > file is treated just like an ossec.conf file, but you can add additional > information in there to identify what clients get what config. > > > Is this documented on the website or in the book? > > I've found the site documentation to be enough to get started, assuming > you're willing to experiment a bit. I have the book on order right now and > I'm eagerly awaiting my copy... My hope is that it is significantly more > detailed than the site.. > > - --------------------------- > Jason 'XenoPhage' Frisvold > [email protected] > - --------------------------- > "Any sufficiently advanced magic is indistinguishable from technology." > - - Niven's Inverse of Clarke's Third Law >
