Hi, the 1.1.1.12 agent has:
1.1.1.12 - 009 (null) the 1.1.1.123 agent has: 1.1.1.123 - 004 (null) -- *Radu Popescu* *mobile:* +40768.748.394 *e-mail:* [email protected] *web:* http://linuxsysadm.wordpress.com On Thu, Jan 17, 2013 at 4:02 AM, Jb Cheng <[email protected]> wrote: > On the agent machine in question, what is the content of the > queue/ossec/.agent_info file? This is the agent name. > The agent name is used to match against the regular expression in the > 'name' attribute of <agent_config name="..."> > > > On Thursday, January 10, 2013 6:09:56 AM UTC-8, pvradu wrote: >> >> Hi, >> >> I have a shared agent.conf that gets on every agent installed in which I >> have multiple agent_config sections. >> For example I have the following config: >> >> <agent_config name="1.1.1.123"> >> ... >> </agent_config> >> <agent_config name="1.1.1.12|2.2.2.2"> >> ... >> </agent_config> >> (my agent names are the same with IP addresses) >> >> The thing is that on machine 1.1.1.123 both configs get loaded (for >> 1.1.1.12 and 1.1.1.123, and I have some duplication errors. >> So, my question is, how can I mark the end of the string in the config >> with 1.1.1.12? So 1.1.1.123 will not match that config. >> Also tried "^1.1.1.12$|2.2.2.2" but with no luck. (like this, the config >> on 1.1.1.123 loads ok, but 1.1.1.12 doesn't get recognized) >> OSSEC version is 2.7. (actually, in the process of upgrading from 2.6) >> >> Thanks, >> Radu >> >
