It should be used automatically, but it may take a while to transfer to the agents. You may be able to speed this up by restarting the server processes. After it has been transferred, you'll have to restart the agent processes.
On Fri, Sep 17, 2010 at 2:25 PM, Jeremy Lee <[email protected]> wrote: > Ah, I just realized that after searching more :) Thanks... I setup an > agent.conf now and restarted the OSSEC server. I don't see any activity in > the log file though - should I be seeing something? Is there anywhere else > (i.e. ossec.conf) where I need to specify the use of agent.conf? > > > > > > On Fri, Sep 17, 2010 at 11:21 AM, dan (ddp) <[email protected]> wrote: >> >> On Fri, Sep 17, 2010 at 2:12 PM, jplee3 <[email protected]> wrote: >> > Hi all, >> > >> > This may have been covered elsewhere, but I can't seem to find it from >> > my initial searches. Is there a setting in the ossec.conf on the >> > server to globally enable syscheck, etc? I have 20-25 agents I want to >> > schedule to run at the same time but it's pretty annoying having to go >> > through every one of them and making changes to the individual >> > ossec.conf files. Will the server enforce a 'policy' if it's specified >> > in the ossec.conf? >> >> You can use the agent.conf for this, but not the server's ossec.conf. > >
