Only the ossec processes on the agents should need to be restarted. The OSSEC manager doesn't need to be restarted (it doesn't use the agent.conf, it only pushes it to the agents). It does not push it right away, and there is no way to trigger a push. You just have to wait.
On Thu, Feb 24, 2011 at 4:35 AM, carlopmart <[email protected]> wrote: > Hi all, > > When agent.conf file is modifiyed, is neccessary to restart all services on > the OSSEC server side or only ossec-remoted/ossec-monitord daemons ?? Or is > agent.conf automatically read by the the ossec server and push it on the > ossec client (or agent)? > > Thanks. > > -- > CL Martinez > carlopmart {at} gmail {d0t} com >
