Hi Mike,
On Mon, Jan 24, 2011 at 6:14 PM, Mike Smith <[email protected]> wrote:
> Error with real time monitoring enabled.
>
> Log file on Windows Agent:
>
> 2011/01/24 16:10:28 ossec-agent(1226): ERROR: Error reading XML file
> 'ossec.conf': XMLERR: Attribute 'realtime' not followed by a " or '. (line
> 107).
> 2011/01/24 16:10:28 ossec-agent: Received exit signal.
>
> I did not see any errors in the ossec.log file on the server, is this where
> I should look.
>
> Thanks,
>
> -Mike
>
Without seeing the line in question, I'm guessing it looks something like this:
<directories realtime=yes ...
There needs to be quotes (") around the "yes" in the attribute.
> On Mon, Jan 24, 2011 at 3:19 PM, dan (ddp) <[email protected]> wrote:
>>
>> Hi Mike,
>>
>> On Mon, Jan 24, 2011 at 5:12 PM, Mike Smith <[email protected]> wrote:
>> > Hello,
>> >
>> > I have my agent working again. Now the reason for the whole upgrade to
>> > get
>> > real time monitoring working.
>> >
>> > Is this the right way to do it for a windows agent
>> >
>> > <syscheck>
>> > <directories realtime="yes"
>> > check_all="yes">c:\inetpub/</directories>
>> > <directories check_all="yes">c:\inetpub/</directories>
>> > </syscheck>
>> >
>> > or this way
>> >
>> > <syscheck>
>> > <directories realtime="yes"
>> > check_all="yes">c:\inetpub/</directories>
>> > </syscheck>
>> >
>> > Thanks,
>> >
>> >
>> >
>> > Mike
>> >
>> >
>>
>> There's no need to duplicated things. The second entry should work
>> just fine. Notice the check_all option is enabled in that entry, so
>> there is no need to make another entry just to enable check_all.
>
>
