On Mon, Aug 27, 2012 at 5:55 PM, dan (ddp) <[email protected]> wrote: > On Mon, Aug 27, 2012 at 1:45 PM, C. L. Martinez <[email protected]> wrote: >> Hi all, >> >> Active response needs to be configured in server an agent to work?? I >> am trying to activate for agents only, but doesn't seems to work ... >> Do I need to configure in ossec.conf's server config file, in >> agent.conf file or in both sides?? >> >> Thanks. > > Active response needs to be enabled on both the server and the agents. > You do not need to configure an active response to run on the server, > so it's almost like having it disabled on the server.
Then, configuring only a command option on server side works??
