On Mon, Sep 3, 2012 at 2:42 AM, 屈鹏飞|Blake Qu <[email protected]> wrote: > Hello guys, > > I have few questions about “Centralized agent configuration”. I > have checked the manual but it’s just too simple -_-!
The manual, concept, or author is too simple? > > Q1: after I edit the etc/shared/agent.conf file,is there any way to > push it to agents immediately ? The manual said that it would if I restart > the agent manager, but actually “bin/ossec-control restart” just doesn’t > work…. > No. It'll push when it wants to. Restarting the agent processes and the server processes generally speeds it up, but not always. "Just doesn't work" is the technical term, right? > Q2:To the agents, the agent.conf and ossec.conf ,which one is priority? > Not sure. I think the ossec.conf takes priority in conflicts, but I haven't checked to make sure. > > > Any info/suggestion ? > > Thanks! > > > > Blake > > > > > >
