The only thing I can think of is that you have an error of some kind in the section
<agent_config os="Windows">...</agent_config> The problem should be pointed to in the log on the agent. Mine is "ossec.log" in the ossec home directory: "C:\Program Files\ossec-agent\ossec.log". -- Shane Castle Data Security Mgr, Boulder County IT CISSP GSEC GCIH -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Kevin Kirschler Sent: Thursday, September 01, 2011 14:46 To: [email protected] Subject: [ossec-list] 2.6 agent.conf os="Windows" not working? Hello all. I have done quite a bit of searching and haven't found an answer. Or anyone else saying they are having this problem, so maybe it is something I am doing. I am just trying out OSSEC at this point. I'm using 2.6. And I am trying to use the centralized agent configuration, because I will be deploying to a few thousand machines if we move forward. Here is the issue. My windows agent is not respecting os="Windows" in the agent.conf. To explain a bit, I have the agent.conf file with a section <agent_config os="Windows">. The ossec.conf file on the agent just has the section pointing to the server. The agent.conf file goes to the agent machine just fine, but when I restart the agent I get notices in the log about nothing being defined for syscheck, and stuff like that. BUT... if I take the "os="Windows"" part out, and just start with <agent_config>, it will work just fine. I restart the agent and the log shows what is expected. Any thoughts on why my agent doesn't seem to like the os="Windows" part? Thanks!
