I believe you have to do on all agent. Also you can do centralized with configure agent.conf file at server.
-- Sent from my iPhone On Feb 10, 2011, at 9:01 AM, Rob <[email protected]> wrote:
I have a ossec installed as master/agent setup. There are about 30 agents running with one master. I recently changed the ossec.conf to monitor changes in directories to real time <directories realtime="yes" check_all="yes">/etc,/usr/bin,/usr/sbin</ directories> <directories realtime="yes" check_all="yes">/bin,/sbin</ directories> do i have to add this change ( realtime="yes" ) to each agents ossec.conf or is just changing it on the master and restarting ossec enough.
