On Wed, Dec 5, 2012 at 9:39 PM, peng lin <[email protected]> wrote: > i see ossec have report function. > if i want use this funcion,i should config it in every agent's conf file,or > only to config server (or hybrid)'s conf file. > > ex. i holp see alert report and file change report . > how should i set up ? every agent or server ?
Since the agents do not create alerts (and do not have alerts.log), reports only makes sense on the server.
