Suppose I have a problem with my OSSEC master. I have the agent software running on another server and decide to use that as a replacement master. What do I need to do to change an agent into a master?
I understand the different use of ossec/etc/client.keys on agents and the master, and that I would need to sort out the contents of ossec/ queue/rids What else would I need to change? or is it easier to start from scratch? Is there a way to set up two masters (perhaps one passive and one active?)
