Small correction. The example of agent.conf should read agent.conf: ----------------
<agent_config os="windows"> .... </agent_config> <agent_config os="Linux"> <-----Changed windows to Linux ... </agent_config> On Fri, Jun 10, 2011 at 10:08 AM, Christopher Moraes <[email protected]>wrote: > Hi George, > > You need to put both the <agent_config> blocks for Unix and windows in the > same agent.conf file on the manager. Like : > > agent.conf: > ---------------- > > <agent_config os="windows"> > .... > </agent_config> > > <agent_config os="windows"> > ... > </agent_config> > > The file will get pushed to all your agents (irrespective of whether they > are unix or windows). However the agent will read only the <agent_config> > block applicable to its OS. > > So your Windows machines will read only the <agent_config os="windows"> > section. > > HTH. > > > On Fri, Jun 10, 2011 at 4:01 AM, GeorgeY <[email protected]> wrote: > >> Hi all, >> >> I am using a shared config for Windows hosts that is being distributed >> from the OSSEC server /ossec/etc/shared/agent.conf. >> >> In agent.conf, I have specified the following: >> >> <agent_config os="Windows"> >> ... >> ... >> </agent_config> >> >> It is distributing it as expected however, I noticed that this file is >> being distributed to my Unix hosts as well. How can I tell the OSSEC >> server to distribute agent.conf to ALL windows hosts and tell it to >> distribute agent-unix.conf to ALL unix hosts only? Can this be done? >> >> Thanks in advance. >> >> George > > >
