On Mon, Jan 24, 2011 at 6:40 PM, Mike Smith <[email protected]> wrote: > Sorry, that might help! > > <directories realtime=”yes” check_all=”yes”>X:\Inetpub/</directories> >
I can't reproduce this off hand. Are you using the realtime option in any of the other entries? Maybe try removing the tailing /. > On Mon, Jan 24, 2011 at 4:18 PM, dan (ddp) <[email protected]> wrote: >> >> Hi Mike, >> >> On Mon, Jan 24, 2011 at 6:14 PM, Mike Smith <[email protected]> wrote: >> > Error with real time monitoring enabled. >> > >> > Log file on Windows Agent: >> > >> > 2011/01/24 16:10:28 ossec-agent(1226): ERROR: Error reading XML file >> > 'ossec.conf': XMLERR: Attribute 'realtime' not followed by a " or '. >> > (line >> > 107). >> > 2011/01/24 16:10:28 ossec-agent: Received exit signal. >> > >> > I did not see any errors in the ossec.log file on the server, is this >> > where >> > I should look. >> > >> > Thanks, >> > >> > -Mike >> > >> >> Without seeing the line in question, I'm guessing it looks something like >> this: >> <directories realtime=yes ... >> >> There needs to be quotes (") around the "yes" in the attribute. >> >> > On Mon, Jan 24, 2011 at 3:19 PM, dan (ddp) <[email protected]> wrote: >> >> >> >> Hi Mike, >> >> >> >> On Mon, Jan 24, 2011 at 5:12 PM, Mike Smith <[email protected]> >> >> wrote: >> >> > Hello, >> >> > >> >> > I have my agent working again. Now the reason for the whole upgrade >> >> > to >> >> > get >> >> > real time monitoring working. >> >> > >> >> > Is this the right way to do it for a windows agent >> >> > >> >> > <syscheck> >> >> > <directories realtime="yes" >> >> > check_all="yes">c:\inetpub/</directories> >> >> > <directories check_all="yes">c:\inetpub/</directories> >> >> > </syscheck> >> >> > >> >> > or this way >> >> > >> >> > <syscheck> >> >> > <directories realtime="yes" >> >> > check_all="yes">c:\inetpub/</directories> >> >> > </syscheck> >> >> > >> >> > Thanks, >> >> > >> >> > >> >> > >> >> > Mike >> >> > >> >> > >> >> >> >> There's no need to duplicated things. The second entry should work >> >> just fine. Notice the check_all option is enabled in that entry, so >> >> there is no need to make another entry just to enable check_all. >> > >> > > >
