On Mar 3, 2011, at 12:30 PM, satish patel wrote: > Look like my managment server pushed agent.conf to client after > restart agent i got follwoing error "No file configured to monitor" I > did specify each and every log files in agents.conf > > Starting OSSEC HIDS v2.5.1 (by Trend Micro Inc.)... > Started ossec-execd... > Started ossec-agentd... > 2011/03/03 09:30:38 ossec-logcollector(1905): INFO: No file configured > to monitor. > Started ossec-logcollector... > 2011/03/03 09:30:38 ossec-syscheckd(1702): INFO: No directory provided > for syscheck to monitor. > 2011/03/03 09:30:38 ossec-syscheckd: WARN: Syscheck disabled. > Started ossec-syscheckd... > Completed.
You may see this on a new client (agent) install, especially if you modify the client ossec.conf to only contain the IP of the server. I handle this by starting the client, waiting a few moments, and then restarting the client. Typically the agent.conf is sent from the server to the client within the first few seconds so a restart causes the client to properly see the agent.conf file and act accordingly. --------------------------- Jason 'XenoPhage' Frisvold [email protected] --------------------------- "Any sufficiently advanced magic is indistinguishable from technology." - Niven's Inverse of Clarke's Third Law
