One of the issues I have with OSSEC, is that's its difficult to determine when your client is using new agent.conf settings. We have the hash that you can view in agent_control, but all that shows you is that client has the new agent.conf, not what config block it is actually using.
I'd like to see, if possible, the client log what config block(s) it has loaded. Just a simple log entry something like: 2010/10/28 09:20:17 ossec-agent: INFO: Loaded agent.conf block: <agent_config os="Windows XP|Windows Server 2003"> -- Shawn Jefferson
