Any updates on this? Are there any alternatives to scheduling OSSEC on a certain day (say Saturday at 3am) every week if scan_day isn't working?
On Sep 24, 3:23 pm, Jeremy Lee <[email protected]> wrote: > I just tried <scan_day> on the OSSEC server and couldn't get it to work. In > fact, looking through the history, I'm not clear that it was ever working - > maybe I just thought it was for some reason. > > On Fri, Sep 24, 2010 at 2:08 PM, Jeremy Lee <[email protected]> wrote: > > Nothing at all. I have debug turned on and I don't see anything appended to > > the ossec.log > > > What is strange is that I could have sworn this was working previously... > > now that I think of it though, it may have only been working on the OSSEC > > server install and not the agent. I will try enabling <scan_day> on the > > server to see what happens. > > > On Fri, Sep 24, 2010 at 2:00 PM, dan (ddp) <[email protected]> wrote: > > >> I'm hoping to have scan_time tested in agent.conf shortly (recent > >> snapshot). I was going to do it last night, but forgot to uncomment my > >> changes... > > >> So what happens when you have scan_day set? > > >> On Fri, Sep 24, 2010 at 4:43 PM, Jeremy Lee <[email protected]> wrote: > >> > I've confirmed that the <scan_day> flag is the one causing the issues > >> I'm > >> > seeing. I still haven't testing <scan_time> in agent.conf but it > >> definitely > >> > is working in ossec.conf (with <scan_day> turned off/commented out).
