Hello all. I have done quite a bit of searching and haven't found an answer. Or anyone else saying they are having this problem, so maybe it is something I am doing.
I am just trying out OSSEC at this point. I'm using 2.6. And I am trying to use the centralized agent configuration, because I will be deploying to a few thousand machines if we move forward. Here is the issue. My windows agent is not respecting os="Windows" in the agent.conf. To explain a bit, I have the agent.conf file with a section <agent_config os="Windows">. The ossec.conf file on the agent just has the section pointing to the server. The agent.conf file goes to the agent machine just fine, but when I restart the agent I get notices in the log about nothing being defined for syscheck, and stuff like that. BUT... if I take the "os="Windows"" part out, and just start with <agent_config>, it will work just fine. I restart the agent and the log shows what is expected. Any thoughts on why my agent doesn't seem to like the os="Windows" part? Thanks!
