On Feb 24, 2011, at 2:33 PM, "dan (ddp)" <[email protected]> wrote: >> <active-response> >> <disabled>yes</disabled> >> </active-response> >> > > This disabled AR on that agent.
This is in the agent.conf, right? I had been disabling specific agents by creating an active response at the top of my ossec.conf with that agent_id identified. This looks MUCH easier and doesn't require a restart of my main OSSEC server.. - Jason
