BTW: I don't suppose there's a way to 'restart all' agents is there? I suppose I could come up with something (iterating loop) via command line...
On Fri, Sep 17, 2010 at 11:30 AM, Jeremy Lee <[email protected]> wrote: > Ah I see... I'm following the guide here: > http://www.ossec.net/main/manual/centralized-config/ > > I verified across several agents that the agent.conf was copied over. > However, I'm not seeing the md5 when I run the 'agent_control -i [agent#]' > command. And I guess there's nothing in the ossec.log that currently > confirms the transfer of the agent.conf (is this available in debug?). > > On Fri, Sep 17, 2010 at 11:27 AM, dan (ddp) <[email protected]> wrote: > >> It should be used automatically, but it may take a while to transfer >> to the agents. You may be able to speed this up by restarting the >> server processes. >> After it has been transferred, you'll have to restart the agent processes. >> >> On Fri, Sep 17, 2010 at 2:25 PM, Jeremy Lee <[email protected]> wrote: >> > Ah, I just realized that after searching more :) Thanks... I setup an >> > agent.conf now and restarted the OSSEC server. I don't see any activity >> in >> > the log file though - should I be seeing something? Is there anywhere >> else >> > (i.e. ossec.conf) where I need to specify the use of agent.conf? >> > >> > >> > >> > >> > >> > On Fri, Sep 17, 2010 at 11:21 AM, dan (ddp) <[email protected]> wrote: >> >> >> >> On Fri, Sep 17, 2010 at 2:12 PM, jplee3 <[email protected]> wrote: >> >> > Hi all, >> >> > >> >> > This may have been covered elsewhere, but I can't seem to find it >> from >> >> > my initial searches. Is there a setting in the ossec.conf on the >> >> > server to globally enable syscheck, etc? I have 20-25 agents I want >> to >> >> > schedule to run at the same time but it's pretty annoying having to >> go >> >> > through every one of them and making changes to the individual >> >> > ossec.conf files. Will the server enforce a 'policy' if it's >> specified >> >> > in the ossec.conf? >> >> >> >> You can use the agent.conf for this, but not the server's ossec.conf. >> > >> > >> > >
