On 03/03/2011 05:09 PM, satish patel wrote:
We have many distro in our network ubuntu/redhat/gentoo etc.. also few
are high end servers and few are low end. so according that i want to
manage them centralized I want to change syscheck scan time frequency
etc.. different on low and high end servers. I want to disable active
response on my iptable firewall server etc.. so how should i maintain
all different different agent requirement in central location ?
In above document they are saying<agent_config name=”agent1|agent2″>
what is this means ? is this my hostname or my agent actual name
which i configured in OSSEC ?
It is your agent's name. One tip: use of <agent_config
name=”agent1|agent2″> doesn't works, at least at 2.5.1. You need to
create an agent config for every agent you like to administer.
And how to disable active response on specific agent ? do i need to
add disable option in agents.conf or individual agents ossec.conf file
?
using centralized configuration, only in agents.conf.
anybody has example files please post me i will appreciate your great help
-Satish
--
CL Martinez
carlopmart {at} gmail {d0t} com
