Ah, I just realized that after searching more :) Thanks... I setup an agent.conf now and restarted the OSSEC server. I don't see any activity in the log file though - should I be seeing something? Is there anywhere else (i.e. ossec.conf) where I need to specify the use of agent.conf?
On Fri, Sep 17, 2010 at 11:21 AM, dan (ddp) <[email protected]> wrote: > On Fri, Sep 17, 2010 at 2:12 PM, jplee3 <[email protected]> wrote: > > Hi all, > > > > This may have been covered elsewhere, but I can't seem to find it from > > my initial searches. Is there a setting in the ossec.conf on the > > server to globally enable syscheck, etc? I have 20-25 agents I want to > > schedule to run at the same time but it's pretty annoying having to go > > through every one of them and making changes to the individual > > ossec.conf files. Will the server enforce a 'policy' if it's specified > > in the ossec.conf? > > You can use the agent.conf for this, but not the server's ossec.conf. >
