Ah I see... I'm following the guide here: http://www.ossec.net/main/manual/centralized-config/
I verified across several agents that the agent.conf was copied over. However, I'm not seeing the md5 when I run the 'agent_control -i [agent#]' command. And I guess there's nothing in the ossec.log that currently confirms the transfer of the agent.conf (is this available in debug?). On Fri, Sep 17, 2010 at 11:27 AM, dan (ddp) <[email protected]> wrote: > It should be used automatically, but it may take a while to transfer > to the agents. You may be able to speed this up by restarting the > server processes. > After it has been transferred, you'll have to restart the agent processes. > > On Fri, Sep 17, 2010 at 2:25 PM, Jeremy Lee <[email protected]> wrote: > > Ah, I just realized that after searching more :) Thanks... I setup an > > agent.conf now and restarted the OSSEC server. I don't see any activity > in > > the log file though - should I be seeing something? Is there anywhere > else > > (i.e. ossec.conf) where I need to specify the use of agent.conf? > > > > > > > > > > > > On Fri, Sep 17, 2010 at 11:21 AM, dan (ddp) <[email protected]> wrote: > >> > >> On Fri, Sep 17, 2010 at 2:12 PM, jplee3 <[email protected]> wrote: > >> > Hi all, > >> > > >> > This may have been covered elsewhere, but I can't seem to find it from > >> > my initial searches. Is there a setting in the ossec.conf on the > >> > server to globally enable syscheck, etc? I have 20-25 agents I want to > >> > schedule to run at the same time but it's pretty annoying having to go > >> > through every one of them and making changes to the individual > >> > ossec.conf files. Will the server enforce a 'policy' if it's specified > >> > in the ossec.conf? > >> > >> You can use the agent.conf for this, but not the server's ossec.conf. > > > > >
