Hey guys,
I've been testing out deploying the agent.conf to machines and am
having trouble with the syscheck scheduling. My agent.conf looks like
this:
<agent_config>
<syscheck>
<scan_on_start>no</scan_on_start>
<scan_time>17:00</scan_time>
<scan_day>Tuesday</scan_day>
<directories check_all="yes">/home/app</directories>
</syscheck>
<localfile>
<log_format>syslog</log_format>
<location>/home/log1</location>
</localfile>
<localfile>
<log_format>syslog</log_format>
<location>/home/log2</location>
</localfile>
</agent_config>
I have verified that the dates are correct on the two agent machines
and the server machine. Syscheck did not kick off at 17:00 today as
verified in the ossec.log and through agent_control -i 001 and 002.
Are there issues with agent.conf properly recognizing the "scan_*"
flags? These obviously work fine in ossec.conf - am I missing
something?
