hi dan (and lis)
yes, the agent conf was copied and I restartet all
but there is something different now:
(agent.conf)
<agent_config name='n001'>
<syscheck>
<ignore>/etc/ppp/chap-secrets</ignore> <<<<<<< file is not ignored
<directories check_all="yes">/lib</directories> <<<<<< this works
</syscheck>
</agent_config>
maybe the syntax is simply wrong?
Mike
2010/10/19 dan (ddp) <[email protected]>
> On Tue, Oct 19, 2010 at 9:38 AM, Mike Sievers
> <[email protected]> wrote:
> > Hi list
> >
> > I am using ossec with agents. But the don't use the:
> > /var/ossec/etc/shared/agent.conf file
> >
> > I really have no idea and no error log.
> > What can be happend?
> > What tests are possible?
> > agent_controls says:
> >
> > ID: 005, Name: n001, IP: 192.168.40.2, Active
> >
> > Best,
> > Mike
> >
>
> Is the agent.conf being copied to the agents? Did you restart the
> ossec processes on the agents?
> Double check your agent.conf for any typos, that's bitten me in the past.
>
