You need to change it in each system's ossec.conf, or utilize the agent.conf. Changing it in the manager's ossec.conf will only affect the manager.
On Thu, Feb 10, 2011 at 9:01 AM, Rob <[email protected]> wrote: > I have a ossec installed as master/agent setup. There are about 30 > agents running with one master. I recently changed the ossec.conf to > monitor changes in directories to real time > > > <directories realtime="yes" check_all="yes">/etc,/usr/bin,/usr/sbin</ > directories> > <directories realtime="yes" check_all="yes">/bin,/sbin</ > directories> > > > do i have to add this change ( realtime="yes" ) to each agents > ossec.conf or is just changing it on the master and restarting ossec > enough. >
