On Mon, Aug 9, 2010 at 11:19 AM, Peter Larson <[email protected]> wrote: > I have installed OSSEC on an Ubuntu server, with the web gui and set up the > config file to send me email alerts, all works fine. I installed the windows > agent on multiple servers and all works well. I then set up the config file > to send all information to an external syslog server which also works fine, > but after having entered that line in the config file, if I try to add a new > agent to the server, I can connect and log in with Putty, but as soon as I > log in, Putty hangs and then throws a fatal error. If I go in and remove the > syslog entry and stop and start OSSEC the agent works fine again, so at this > point I have 2 config files that I rename when I need to add a new agent, > but documentation on where to put the syslog server reference is a bit > cryptic, I have it below the global email settings, is there a better way of > doing this? (config attached) > > Thanks in advance, Peter
The placement shouldn't be a problem. What error does Putty give you? Is there also an error in the ssh logs?
