Sorry, that might help!
<directories realtime=”yes” check_all=”yes”>X:\Inetpub/</directories>
On Mon, Jan 24, 2011 at 4:18 PM, dan (ddp) <[email protected]> wrote:
> Hi Mike,
>
> On Mon, Jan 24, 2011 at 6:14 PM, Mike Smith <[email protected]> wrote:
> > Error with real time monitoring enabled.
> >
> > Log file on Windows Agent:
> >
> > 2011/01/24 16:10:28 ossec-agent(1226): ERROR: Error reading XML file
> > 'ossec.conf': XMLERR: Attribute 'realtime' not followed by a " or '.
> (line
> > 107).
> > 2011/01/24 16:10:28 ossec-agent: Received exit signal.
> >
> > I did not see any errors in the ossec.log file on the server, is this
> where
> > I should look.
> >
> > Thanks,
> >
> > -Mike
> >
>
> Without seeing the line in question, I'm guessing it looks something like
> this:
> <directories realtime=yes ...
>
> There needs to be quotes (") around the "yes" in the attribute.
>
> > On Mon, Jan 24, 2011 at 3:19 PM, dan (ddp) <[email protected]> wrote:
> >>
> >> Hi Mike,
> >>
> >> On Mon, Jan 24, 2011 at 5:12 PM, Mike Smith <[email protected]>
> wrote:
> >> > Hello,
> >> >
> >> > I have my agent working again. Now the reason for the whole upgrade
> to
> >> > get
> >> > real time monitoring working.
> >> >
> >> > Is this the right way to do it for a windows agent
> >> >
> >> > <syscheck>
> >> > <directories realtime="yes"
> >> > check_all="yes">c:\inetpub/</directories>
> >> > <directories check_all="yes">c:\inetpub/</directories>
> >> > </syscheck>
> >> >
> >> > or this way
> >> >
> >> > <syscheck>
> >> > <directories realtime="yes"
> >> > check_all="yes">c:\inetpub/</directories>
> >> > </syscheck>
> >> >
> >> > Thanks,
> >> >
> >> >
> >> >
> >> > Mike
> >> >
> >> >
> >>
> >> There's no need to duplicated things. The second entry should work
> >> just fine. Notice the check_all option is enabled in that entry, so
> >> there is no need to make another entry just to enable check_all.
> >
> >
>
