One other question: are there separate options for scheduling rootcheck? It seems syscheck is on the correct schedule, however, I noticed this morning that all my agents kicked off rootcheck processes at the same time.
On Sep 28, 11:20 am, "dan (ddp)" <[email protected]> wrote: > On Tue, Sep 28, 2010 at 1:31 PM, Jeremy Lee <[email protected]> wrote: > > That makes sense. I guess what I'd really want to see the option to > > push/update just a single 'config' file (ossec.conf) to all clients :) > > If the only configuration you do in the ossec.conf is the server IP, > then pushing out the agent.conf is basically what you're asking for.
