I like your idea too and had initially thought about creating a nesting of profiles in the agent_config. This seems like a neat way of doing merging.
> The latter. So, on any given machine I can do something like this : > > <ossec_config> > <client> > <server-ip>10.200.36.157</server-ip> > <config-profile>LinuxOracleDBServer,LinuxWebServer</config-profile> > </client> > </ossec_config> > > Or > > <ossec_config> > <client> > <server-ip>10.200.36.157</server-ip> > <config-profile>LinuxOracleDBServer</config-profile> > <config-profile>LinuxWebServer</config-profile> > </client> > </ossec_config> > > > Note : I'm thinking out loud here.. I like being able to use merging to > create profiles for disparate parts and combine them together as needed. > > >
