On Mon, Aug 27, 2012 at 1:57 PM, C. L. Martinez <[email protected]> wrote: > On Mon, Aug 27, 2012 at 5:55 PM, dan (ddp) <[email protected]> wrote: >> On Mon, Aug 27, 2012 at 1:45 PM, C. L. Martinez <[email protected]> wrote: >>> Hi all, >>> >>> Active response needs to be configured in server an agent to work?? I >>> am trying to activate for agents only, but doesn't seems to work ... >>> Do I need to configure in ossec.conf's server config file, in >>> agent.conf file or in both sides?? >>> >>> Thanks. >> >> Active response needs to be enabled on both the server and the agents. >> You do not need to configure an active response to run on the server, >> so it's almost like having it disabled on the server. > > Then, configuring only a command option on server side works??
All AR configuration (other than enabling/disabling AR on an agent) is done on the server side.
