On Mon, Aug 27, 2012 at 1:45 PM, C. L. Martinez <[email protected]> wrote: > Hi all, > > Active response needs to be configured in server an agent to work?? I > am trying to activate for agents only, but doesn't seems to work ... > Do I need to configure in ossec.conf's server config file, in > agent.conf file or in both sides?? > > Thanks.
Active response needs to be enabled on both the server and the agents. You do not need to configure an active response to run on the server, so it's almost like having it disabled on the server.
