Hi Frank, If I create an agent.conf file on the server, will it overwrite the settings of the agent's local ossec.conf or are the two configs merged in some way?
On Mon, Jun 6, 2011 at 6:29 AM, Frank Stefan Sundberg Solli < [email protected]> wrote: > Hi. > > The file can be found in shared/agent.conf > > > On Mon, Jun 6, 2011 at 3:42 AM, treydock <[email protected]> wrote: > >> What settings from the OSSEC server's etc/ossec.conf file are used to >> on the clients? For example I've defined rules and active responses >> on my server, and they are working fine, but what about <localfile> >> items? Is there a way to centrally define what local files an agent >> should be checking, or would this be the case where something like >> Puppet comes into play? I have this on my server, and it works, but >> just realized I probably need to push this to my clients, >> >> >> <localfile> >> <log_format>syslog</log_format> >> <location>/var/ossec/logs/active-responses.log</location> >> </localfile> >> >> Thanks >> - Trey > > > > > -- > MVH/With regards > > Frank > -- > Name: Frank Stefan Sundberg Solli > E-mail: [email protected] > Web: http://fssol.blogspot.com > GPG: 684119F4 > >
