We manage some networks on behalf of customers. We would like our customers servers to report locally so they can monitor themselves (yes with AnaLogi) but also report to our main site for us to monitor. Having all Ossec clients report to one server and letting all all our customers see this is not an option due to information leakage.
Either a hybrid option, or just having two <server-ip> listed in the ossec-agent.conf would help massively. On Wednesday, August 1, 2012 6:46:48 AM UTC+1, CarlosFromPhilly wrote: > > Why not simply have each of the agents speak directly to the central OSSEC > server (rather than deal with a second layer)? > Perhaps you could configure it with multiple adapters/IP addresses so that > it has a presence on each of your subnets/networks. > > Sent from my iPhone > > On Jul 31, 2012, at 11:01 PM, Patrick <[email protected]> wrote: > > > Hi, > > > > We're looking at OSSEC and I'm wondering if it supports the following > config Ossec Agent -> Ossec Server -> Ossec Server? > > > > We have multiple LAN segments and want to have a central OSSEC > aggregation point in each segment, then have that aggregation point forward > logs to a central OSSEC server. > > > > I already have OSSEC agents talking to their respective OSSEC agg point > in their zone, however need assistance getting the agg points talking to > the final OSSEC server. > > > > Is this supported/achievable? > > > > Thank you for any info you can provide. > > > > Pat >
