On the agent machine in question, what is the content of the queue/ossec/.agent_info file? This is the agent name. The agent name is used to match against the regular expression in the 'name' attribute of <agent_config name="...">
On Thursday, January 10, 2013 6:09:56 AM UTC-8, pvradu wrote: > > Hi, > > I have a shared agent.conf that gets on every agent installed in which I > have multiple agent_config sections. > For example I have the following config: > > <agent_config name="1.1.1.123"> > ... > </agent_config> > <agent_config name="1.1.1.12|2.2.2.2"> > ... > </agent_config> > (my agent names are the same with IP addresses) > > The thing is that on machine 1.1.1.123 both configs get loaded (for > 1.1.1.12 and 1.1.1.123, and I have some duplication errors. > So, my question is, how can I mark the end of the string in the config > with 1.1.1.12? So 1.1.1.123 will not match that config. > Also tried "^1.1.1.12$|2.2.2.2" but with no luck. (like this, the config > on 1.1.1.123 loads ok, but 1.1.1.12 doesn't get recognized) > OSSEC version is 2.7. (actually, in the process of upgrading from 2.6) > > Thanks, > Radu >
