On 10/27/2011 03:28 AM, carlopmart wrote:
On 10/27/2011 01:55 AM, Michael Starks wrote:
On 10/26/2011 07:15 AM, carlopmart wrote:
b) Ability to use agent collectors. For example for remote locations,
one server acts a collector for a remote LAN and forwards all alerts,
logs, etc to the central OSSEC server.
You should be able do this now. Install a manager in one of your
downstream locations, then install a client on the same box. Point it to
the alerts.log of the manager. I think the only problems you will have
are with active response and perhaps the upstream logs will look like
they all came from the manager, instead of the individual agents.
But I need active-response working for some clients ...
Well, what I really meant was that active response cannot be managed
from the top-most tier. It should still work for the site level.
