Every time an agent is first connected, OSSEC generates an alert for it: "Rule: 501 (level 3) -> 'New ossec agent connected.'"
So you can probably use that to get more information when it was first connected... But there is no easy (standard) way to detect when the client.keys file was modified (only if you add that to syscheck). thanks, -- Daniel B. Cid http://dcid.me On Thu, May 31, 2012 at 2:07 PM, Maahkus <[email protected]> wrote: > Is there a log file that displays what authenticated user or the date > and time a new agent was added? I need to track a newly added agent to > the user that added - can't seem to figure out how.. > > Regards,
