I moved back to using ossec.conf and had <scan_day> set but it still wouldn't kick off. Tried again today and removed <scan_day> and syscheck kicked off this time. Is the <scan_day> flag case sensitive? Once the syscheck finishes I'm going to add <scan_day> back in again and test more. Hopefully it works at least for the ossec.conf
I'll have to keep testing with agent.conf when I get more time. On Thu, Sep 23, 2010 at 1:58 PM, dan (ddp) <[email protected]> wrote: > No other ideas at the moment. I'll try setting it up to see what happens. > > On Thu, Sep 23, 2010 at 2:55 PM, Jeremy Lee <[email protected]> wrote: > > I tried changing the time and ensured that the time is correct on both > > servers. However, it's still not getting kicked off for some reason. I > don't > > see anything in the ossec.log even with full debugging on. I know there's > a > > slight delay before syscheck kicks off, but it shouldn't be more than 5 > > minutes. And I've tried updating agent.conf with the <scan_time> to be > far > > in advance. It's just not working for some reason. Any other ideas? > > >
