Hi George, You need to put both the <agent_config> blocks for Unix and windows in the same agent.conf file on the manager. Like :
agent.conf: ---------------- <agent_config os="windows"> .... </agent_config> <agent_config os="windows"> ... </agent_config> The file will get pushed to all your agents (irrespective of whether they are unix or windows). However the agent will read only the <agent_config> block applicable to its OS. So your Windows machines will read only the <agent_config os="windows"> section. HTH. On Fri, Jun 10, 2011 at 4:01 AM, GeorgeY <[email protected]> wrote: > Hi all, > > I am using a shared config for Windows hosts that is being distributed > from the OSSEC server /ossec/etc/shared/agent.conf. > > In agent.conf, I have specified the following: > > <agent_config os="Windows"> > ... > ... > </agent_config> > > It is distributing it as expected however, I noticed that this file is > being distributed to my Unix hosts as well. How can I tell the OSSEC > server to distribute agent.conf to ALL windows hosts and tell it to > distribute agent-unix.conf to ALL unix hosts only? Can this be done? > > Thanks in advance. > > George
